APT does not (or did not when I last checked) protect you from replay attacks: https://bugs.debian.org/863317 https://bugs.debian.org/863317 Given the amount

APT does not (or did not when I last checked) protect you from replay attacks: https://bugs.debian.org/863317 https://bugs.debian.org/863317 Given the amount of time I spent on researching this bug (I tried literally the first thing that came to my mind and it worked), I suspect there's a lot more security bugs in APT lurking.