Re: [arch-general] [arch-dev-public] todo list for moving http -> https sources

When it comes to security of online update mechanisms and that of an index, TUF has a well designed scheme to be safe regardless of http and plan for eventual leak/theft of signing keys. I'd suggest anyone interest to have a look.