Every mirror will know that because of HTTPD logs.

In fairness to GP, that wouldn't be a man in the 'middle', the mirror is the end destination for your traffic.

well when CA use 4 as key that kinda matters less

They usually don't.

But sometimes do

What's the argument then? Not signing the packages anymore because that has now been faulty?

There's no sensible argument here.

That’s not very typical, I’d like to make that point.

So you're not using internet banking any more?

> preventing a mitm from knowing what packages you install

Package size is unique enough that just seeing the size of the transfer will usually be enough to tell.

Apt uses persistent connections and has multiple requests in flight at once (Acquire::http::Pipeline-Depth). If you acquired the entire history of downloads then you could match it against software updates, and possibly identify by-choice dependency sets, but it would be quite a project.