On: Why does APT not use HTTPS?

[dTal]

I was thinking that - there would have to be zero latency between requests to avoid leaking package size information. Not impossible, but damn hard.