Quicklisp, ironically, only updates once a month. It's managed like a Linux distro. That means the client has a full index of every library in the registry, and knows the hash of every file it may download.

I am pretty sure quicklisp checks the hashes it downloads. Hence, the only security issue with using HTTP seems to be that middleman can see what you've downloaded... if they try to change it in any way, the quicklisp client will reject the download as far as I know (though I haven't checked the code).

Do you believe this is not sufficient, and why?