Easier to put caching proxies on the path?

It's not the default, but you can install apt-transport-https and then just change the update URLs to https assuming your mirror supports that.

I would speculate that it's inertia due to decisions made a decade or two ago, before we decided that everything should run via HTTPS.

theoretical model means that the transfer method doesn't matter.

Of course, that breaks if implementation checks the signatures in wrong moment

I get it to a point because it can be a chicken and egg situation sometimes, but there has got to be a better way.