Certificate pinning helps with Github, but doesn't help with <random website that I've never visited before>. (Still doesn't help if the software package itsel

Certificate pinning helps with Github, but doesn't help with <random website that I've never visited before>. (Still doesn't help if the software package itself - that is the canonical copy - is malicious - but prevents MITMing from anyone that doesn't have that particular certificate, at least.) That being said, you have a (very) valid point. Modern OSes are... not exactly secure.