Emanuel Berg via Users list for the GNU Emacs text editor
<help-gnu-emacs@gnu.org> writes:

> Amin Bandali wrote:
>
>> Lastly, I recommend using https rather than
>> http if your Emacs was built with
>> GnuTLS support.
>
> OK, then it should be
>
> (setq package-archives
>       '(( "gnu elpa" . "http://elpa.gnu.org/packages/")
>         ( "melpa"    . "https://melpa.org/packages/" )))

Except that it still hardcodes (insecure) http for the GNU ELPA archive.
To check if GnuTLS is available, you can check if (gnutls-available-p)
returns non-nil, and if so then use https for the package archives.  On
emacs >= 26.1, `package-archives' does this for the GNU ELPA entry that
it comes with out of the box.