Comment by kiallmacinnes

The signature method used by Linux mirrors has existed longer than HTTPS has, there's nothing homebrew about it.