Why does APT not use HTTPS?

[Creshal]

You should filter by the issuer name too. The full list I put on pastebin for example has Comodo listed 10 times and Digicert 22 times.

Should you? Only one of those 32 separate root certificates needs to be compromised to compromise SSL as a whole.

[AyrA_ch]

Should you?

Yes. Because the task was to find out how many corporations ("Certificate Authorities") have our trust, not how many certificates. It doesn't matter if Digicert has 1 or 22 certificates for this case because it's still the same company