[charcircuit]

Why doesn't windows update use authentication (eg https)?

[acdha]

They do: the updates are signed so our hypothetical spies would need to have a zero day in Authenticode or to have compromised the signing keys.