> Ok I guess but then why did Debian switch to https?

Because security people kept bullying them?