Just to be clear (and I realise I never specified that), I was merely
talking about the "files" mirror, aka the CD/DVD ones.

I was *not* discussing the packages ones, for which, as I stated from
the very start, the APT protocol ensures integrity/authentication with
help from GPG.
This has been repeated several times by different people in various ways.

Hence, talking about the installation media, even if people manually
verify signatures (no added security if server is compromised), at least
HTTPS would ensure channel protection. Some could also argue privacy
relative to URL paths.

Anyone on this?

Bernard (Beer) Rosset
https://rosset.net/