Why does APT not use HTTPS?