for debian security https we can use:
deb https://deb.debian.org/debian-security stretch/updates main
qubes onion has this issue:
https://github.com/QubesOS/qubes-issues/issues/2604#issuecomment-330423579though its possible to make deb.qubes repo going through https:
deb [arch=amd64] https://deb.qubes-os.org/r4.0/vm stretch main
Edit: we can allow onion qubes repo inside Whonix, but Qubes itself might use only https. (which is still better than the http)
@Patrick shall i ticket this to phabricator or no need?