points
The default for package upgrades on PCs should be HTTPS (as it already is on Arch, Alpine, NixOS, Flatpak, and Homebrew) since it reduces risk with minimal performance impact for most users.