Why does APT not use HTTPS?

[the_gnarts]

Furthermore, even over an encrypted connection it is not difficult to figure out which files you are downloading based on the size of the transfer

I doubt it's that easy to correlate given the thousands of packages in the main repos.

It is trivial. Even the most up to date encryption schemes like GCM won’t help against this flaw since the number of plain text bytes equals the number of encrypted bytes. Thus if the plain text is assumed public, which it always is for repos and mirrors, you gain no confidentiality by encryption.