The point the author is making is that at least your third-party plugins should be protected from tampering in transit. Don't think this is only restricted to

The point the author is making is that at least your third-party plugins should be protected from tampering in transit. Don't think this is only restricted to state-level actors. With even commercial routers like Cisco and Juniper shipping with backdoors, and of course personal routers with vulnerabilities all over the place, it's not an especially heavy lift to take over a bunch of last-mile routers. There are tons of these unprotected attack vectors, and the author is right that we need to start rooting each one out. It all starts with your OS's keys (or below your OS, in UEFI!) This is probably even more of an issue for Linux distros that serve their initial install CD's (or bittorrent links) over HTTP. That's an easy vector for a third party to slip in a replacement CD/DVD and checksums, or even just slipstream in the changes without bothering with the checksums, since probably most people never check the digests and if they did and they didn't match, they'd just figure it was a bad download and never suspect a thing. When people say "oh, no one cares about me", it's simply not true. That's why there's > million viruses out there. That's why ransomware exist. Oh, yes. they care.