Even though the packages are signed cryptographically, there are possible risks when using an unencrypted connection.

A man-in-the-middle attack could simply work by serving you a signed, but outdated packages list, preventing your distribution from updating and leaving you vulnerable to security holes. It's the same attack an evil mirror could do as well.

So if you want to be really sure you should probably use two independent mirrors over an HTTPS connection.