[willstrafach]

This is also how Apple’s cache server works, otherwise it would need to break the TLS connection, and that is not an improvement.

I have personally looked at the accompanying connections and it looks like Apple sends hashes over a proper TLS connection. Updates are also signed as another layer of security.