yes, and its turtles all the way down, but its much harder to compromise (multiple) key servers than a simple download mirror. Its also trivial to setup some so

yes, and its turtles all the way down, but its much harder to compromise (multiple) key servers than a simple download mirror. Its also trivial to setup some sort of totally unknown checking setup, that downloads the packages daily and checks if they are properly signed, and activates big red sirens if it is not.