Using HTTP for 'apt update' is common practice. Neither Debian or Ubuntu use https for their repositories. Instead the metadata for each repository is signed with a gpg key. The associated public key is distributed with the installation media and used to verify the metadata. The metadata includes checksums for the other files in the repository. Debian and Ubuntu include MD5, SHA-1 and SHA-256 checksums. Termux includes just the SHA-256 checksums. These checksums are used to verify the integrity of the other files in the repository.