After an insane amount of comment-troubleshooting, it turns out
this guy has set up a firewall which denies HTTP connections with a
200 OK and a bogus response, which causes APT, amongst other things, to fail with cryptic errors (stdin is not bzip file, etc.). <headbang>