This is a serious issue to some users in the middle east which they are facing, HTTP default Debian is not really good idea for them nor its secure. for the full article it has been explained here: https://github.com/QubesOS/qubes-issues/issues/4415 We hope at least to fix Debian Security Repo to use HTTPs.