content: There is no risk transporting a public signed executable over an unencrypted connection, as long as the thing downloading and installing them is looking for that and requiring it. Certificate revocation lists, an integral part of HTTPS, are often transmitted "unencrypted" as well. With the patches you're not worried about confidentiality, you're worried about integrity. Signing the executable achieves this. Now... If these are patches on a HTTP website that they're sending users to with their browsers, and not just the endpoint that the windows updater reached out to, that is fucked.