And this wasn't noticed for such a long time... RPMFusion: http://rpmfusion.org/RPM%20Fusion?action=recall&rev=194
They locked the pages after several months (5 minute work), not without the need for me to poke them, and they still didn't move to HTTPS...
https://software.opensuse.org/132/en - they have HTTPS, but only on software.opensuse.org, not on opensuse.org and it's not default.
Debian: https://www.debian.org/distrib/netinst - I couldn't find verification instructions for netinstall images, or any verification instructions at all. There are GPG signatures though.
Linux Mint: no HTTPS at all.
