I am once again baffled that apparently nobody is caching random blobs like source tarballs, because only 'busybox wget' can issue 'GET https://...' to a proxy (wget and curl issue CONNECT for https resources), and Squid doesn't interoperate with 'busybox wget', as it sends TCP FIN early — I had to use nginx with 'proxy_ignore_client_abort on'.
But now we finally have a setup where we can have a caching http(s) proxy in front of containers that rebuild a distro.