galeforcewinds

Why don't CentOS/Fedora/Ubuntu deliver all package updates over https, and encourage third-party package providers to do the same?

I understand SSL/TLS reduces the risk of data tampering and reduces the risk of snooping what data is downloaded.

Though risk data tampering may also be reduced through the validation of cryptographically signed packages as many distros do, it would seem there remains a residual risk of exposing to the network which updates a system has downloaded. Is there reason this isn't of concern?