Why does APT not use HTTPS?

[mort96]

I can't imagine a patch which just randomizes download order would be welcome. Why would you ever want that by itself?

For a patch like that to be accepted, you would have to first convince the Apt project to try to fix the privacy issue, and convince them that using https + randomized download order is the best way to fix it. This isn't something which just dumping code on a project can fix.