[squid-users] cache deny, but still getting tcp hits

I'm trying to run squid alongside apt-proxy. To keep things cleaner, I'm
trying to keep squid from caching apt-proxy requests, or basic Ubuntu
repositories.

I added this code to my squid.conf file:
acl ubuntu_repo dstdomain archive.ubuntu.com archive.canonical.com
security.ubuntu.com ke.archive.ubuntu.com
cache deny ubuntu_repo

but I'm still getting TCP hits on those domains:
root_at_kimende-s:~# tail -F /var/log/squid/access.log | grep "TCP_HIT"
1265098628.591 26 10.42.43.13 TCP_HIT/200 93875 GET
http://ke.archive.ubuntu.com/ubuntu/pool/main/g/grub2/grub-common_1.96+20080724-12ubuntu2_i386.deb
- NONE/- application/dpkg
1265098628.600 8 10.42.43.13 TCP_HIT/200 16494 GET
http://ke.archive.ubuntu.com/ubuntu/pool/main/g/grub/grub_0.97-29ubuntu53_i386.deb
- NONE/- application/dpkg
1265098628.665 63 10.42.43.13 TCP_HIT/200 404514 GET
http://ke.archive.ubuntu.com/ubuntu/pool/main/g/grub/grub_0.97-29ubuntu53_i386.deb
- NONE/- application/dpkg
1265098750.278 392 10.42.43.11 TCP_HIT/206 315 GET
http://security.ubuntu.com/ubuntu/dists/jaunty-security/main/source/Sources.bz2
- NONE/- text/plain
1265098750.278 394 10.42.43.11 TCP_HIT/206 315 GET
http://security.ubuntu.com/ubuntu/dists/jaunty-security/main/source/Sources.bz2
- NONE/- text/plain
1265098750.279 1 10.42.43.11 TCP_HIT/206 0 GET
http://security.ubuntu.com/ubuntu/dists/jaunty-security/restricted/source/Sources.bz2
- NONE/- text/plain

Is this normal? It seems like it's still caching....
Attached is my squid.conf file.