On: Why does APT not use HTTPS?

[brazzy]

> Also, can we do it on top of the current Debian infrastructure (HTTP and everything)?

I'm pretty sure that is not possible, because the current infrastructure is just plain old HTTP file servers (anything that can sling bits will do) run by whoever fancies being a part of it.

[marcosdumay → brazzy]

If you create an onion layer like the GP proposes, I don't see any loss from it running over HTTP servers.