Comment by sneak

This is all pointless handwaving; the update package itself is signed and will not install if tampered with, regardless of TLS certs used to download it.

TLS is not used to authenticate the update.