The main recommendation is "always serve your apt repo over TLS", however, apt doesn't use TLS by design: https://whydoesaptnotusehttps.com/