If done properly signing ought to prevent issues, but I'm guessing you can either spoof the signing or it doesn't contain all of the metadata to ensure it's the correct package?
Also shouldn't HTTPS be marginally faster when doing multiple packages these days? HTTP2 allows for multiple downloads over a single connection and a single TLS tunnel which skips a bunch of handshakes and everything has HW accelerated cryptography anyway. Maybe it just doesn't properly support HTTP2?