It is an interesting solution to a problem that hasn't really affected many. The bigger issue is one should not automatically trust packages and should audit e

It is an interesting solution to a problem that hasn't really affected many. The bigger issue is one should not automatically trust packages and should audit each before using because chances are the attack vector in the source is a bigger target than a man in the middle attack.