Created attachment 205638 [details] patch Local distfiles can't be fetched or initially checksummed securely without an HTTPS mirror. This adds one hosted on pkg.freebsd.org.
This is up to portmgr.
(In reply to Miyashita Touka from comment #0) Local distfiles are not supposed to be used for initial checksum, they are a backup in case the main mirror is temporarily unavailable
The fact that pkg.freebsd.org has a local-distfiles directory is an artefact of how mirroring is done, it should NOT, be used, or taken for granted.