Yeah it’d be better to use https since it lists some checksums, but it was last updated in 2018, and Debian packages are verified anyway.
Hopefully anyone interested for more than academic reasons does their research on the range of solutions more widely available.