> that is updated regularly and uses both a secure transport layer for pacman and doesn't allow "some random guy's" gpg signatures, aka you'd have to manually c

> that is updated regularly and uses both a secure transport layer for pacman and doesn't allow "some random guy's" gpg signatures, aka you'd have to manually check every source from AUR. To be fair, all three of those are the defaults on any distro I've ever used. You have to say explicitly "no, I do not want to inspect this PKGBUILD file" in pretty much every AUR helper (and it's worth noting AUR helpers aren't even the supported way of building AUR packages).