Debian has had the option to use Tor to update for quite some time, but most users don’t even know that it’s an option or how to set it up, and it turns out it is quite simple!
Firstly, you will need to install Tor.
Once that is complete you need to make sure you have apt-transport-tor installed:
sudo apt install apt-transport-tor
now all you need to do is edit your /etc/apt/sources.list file, replacing all the normal Debian mirrors with the .onions. You can find a list of up to date mirrors at the bottom of this page. Here are the current ones:
deb tor+http://vwakviie2ienjx6t.onion/debian stable main
deb tor+http://vwakviie2ienjx6t.onion/debian stable-updates main
deb tor+http://sgvtcaew4bxjd7ln.onion/debian-security stable/updates main
#deb tor+http://vwakviie2ienjx6t.onion/debian stable-backports main
Note: I changed the repo from jessie to stable in anticipation of Debian 9 being released.
Last thing to do is run apt update and you will be running all of your update traffic through an onion service, so you can be sure the packages are not compromised during transfer!