While I like the foundation of this idea, I'd love to see it taken to the next logical conclusion: Drop HTTP for a better suited protocol (like 9P), and correctly handle the interaction of union'd (namespaced) filesystems.
The backend actually doesn't care about the protocol used and indeed any protocol could be transparently substituted in using the config file... However there is nothing that makes 9P better suited in this particular case since the resources requested are completely static URLs with the exception of the "index" resource which lists the SHA1 of the list-of-packages as well as the digital signature of the "index" file itself.