I guess he means the import directly from github and other online code repos are not signed or checked in any manner. Still imports from online code repositorie

I guess he means the import directly from github and other online code repos are not signed or checked in any manner. Still imports from online code repositories are supposed to be a convenience to get started faster and should be replaced by a better dependency management in production.