It does not help you if the originating server has been hacked, which is by far the most likely attack vector (after people being assholes on the internet or ma

It does not help you if the originating server has been hacked, which is by far the most likely attack vector (after people being assholes on the internet or making mistakes in their script). Protecting against that is the whole fucking point of using things like apt-get/PEAR and GPG/code signing.