In this setting, HTTPS provides integrity (the authoritative party is the package index, which can serve you anything.) It can't provide authenticity, which is the root of most of the more interesting attack vectors in packaging.