Considering TODO:

• remove clearnet apt sources
• keep onion apt sources

(At the moment both clearnet and onion sources are being used with priority given to onions and clearnet as a fallback in case of onion connectivity issues.)

• https://github.com/Whonix/anon-apt-sources-list/blob/master/etc/apt/sources.list.d/debian.list
• https://github.com/Whonix/anon-shared-build-apt-sources-tpo/blob/master/etc/apt/sources.list.d/torproject.list
• Qubes onion - https://forums.whonix.org/t/onionizing-qubes-whonix-repositories

Related:
deb.debian.org instead of us.debian.org and use https (SSL, TLS) by default - T721