Why does Updating force the user to download complete cache packages

I'm afraid this isn't a feature of a Debian-based system. STATUS_ACCESS_DENIED is correct about integrity checking. gpg keys are stored for repositories. Release files are stored in repositories and are signed. Those release files contain checksums for the various Package files, which contain lists of packages. Each package description contains checksums for each component as a whole.

Debian has done work to reduce the bandwidth required for apt-get by using package diffs, but they don't seem to reduce the bandwidth required to do an apt-get upgrade, only apt-get update (not the packages themselves, only the Package files). I've been told that Ubuntu doesn't support this. For a description see http://www.debian-administration.org/articles/439

You may be interested in the Exherbo or Funtoo. See https://unix.stackexchange.com/questions/36357/git-based-package-manager-installer-for-linux. Git wasn't around when the debian project was created. It signs individual objects and keeps a chain of checksums to ensure integrity.