> The security facepalm is the fact that you're pulling source code without signature verification.

> And why do you trust that the author has no plans in the future to inject malicious code?

Signature verification is used to protect against malicious authors now?