To be fair, I'm downloading packages over plaintext anyway, so there are several big tech companies (my ISP, various backbone operators) who are already privy to the aforementioned information.
I guess I could try to find a Debian mirror that offers HTTPS, but that's kinda hard on the server's CPU, and I'd hate to burden #Debian infrastructure any more than I already do. They've been my most trusted and cherished operating system for nearly 30 years, after all. ❤️