I wouldn't call Quicklisp slick but I would call it dangerous. HTTPS is irrelevant when it fetches projects, it stores in its own central repo, over HTTP and pl

I wouldn't call Quicklisp slick but I would call it dangerous. HTTPS is irrelevant when it fetches projects, it stores in its own central repo, over HTTP and plain GIT. That model of a middleman NOT the original package author being responsible for distribution is highly problematic. A package manager today needs to maintain and make it simple to verify end-to-end provenance.