That is what I mean about it only being better in the limited scenario where you are getting the package from an already-trusted central repo. But that is surel

That is what I mean about it only being better in the limited scenario where you are getting the package from an already-trusted central repo. But that is surely not the case in this particular situation for example.