[mdt711]

Launchpad doesn't look very trustworthy either: https://launchpad.net/projects/+all

[DarkStar851]

Launchpad is public, think GitHub but for packages. The Canonical Launchpad repositories weren't tampered. Presumably a lot fewer people have commit access to LP since it's used for package distribution.