[dragonwriter]

> The request itself won't be tampered with, but what if the host was?

What if your distro package repository was?