Yes, it is insecure to use http instead of https because it can be attacked by man-in-the-middle, by DNS spoofing or in other ways, so you get the wrong key and also wrong software. Checking the fingerprint of the key would not help either unless you got the fingerprint by https.
And while it would be better to use https, it would not mean that TLS provides full security. All it provides is security of the transport which means:
- You need still to trust the site itself. How to you know that this site does not intent to serve malware to you? Where did you get the information about the site from? How trustworthy was the person/site providing this information and was the transport protected by https?
- You need to trust the security of the site. It might be hacked and serve wrong key and software.
- You need to trust the author or distributor of the software that it does not contain any bugs or even backdoors.
Given that hacking a site or setting up a similar looking phishing site (which might use TLS too) is often easier than mounting a man-in-the-middle attack you should ask yourself if using TLS would be enough to provide the level of security you need.
gpg --with-fingerprint dotdeb.gpg