[gnfurlong]

I'll admit to being ignorant of apt as my primary distributions aren't debian based, but aren't packages cryptographically signed? If package signatures are validated after download, then it shouldn't matter right? Edit: Skimming and I shamefully didn't the read grandparent post. The link addresses exactly this point.