I think you're missing the point. Security is achieved through layers of protection that an attacker must defeat in order to take a malicious action. The techno

I think you're missing the point. Security is achieved through layers of protection that an attacker must defeat in order to take a malicious action. The technologies being discussed here solve different problems: SSL - Validates that you are actually connecting to the server represented by the URL and that no one is listening/inserting information in between. Author signed packages - Validates that the package contains only what the author has released. Yes, it's possible for both to be compromised with enough work, but that's the point: "with enough work". We can't prevent attacks 100%, but we can layer up security so that an attacker's chances of finding a usable exploit approach zero when looking at the full chain.