An here we see: The Debian people never introspect or change, because they were the first ones in open source, have too much power and outnumber the critics.

Truth by flagging.

many mirrors are also available over https, you can just change that

Basically all of them are, many of the larger mirror servers host multiple distributions, with some defaulting to/requiring HTTPS nowadays anyway.

>How are you going to update if apt is compromised?

Download the package with your http client of choice, install with sudo dpkg --verify -i

I’ll just note that you had to go back more than 20 years to get that short list of complaints.

When Ian Murdock was alive, Debian had much better quality. I never believed it was a suicide, especially now, after such a long history of critical incidents like the ones you mentioned. They don't look random anymore and it feels like they were all introduced on purpose by the same people who wanted us to believe the suicide version.