To your points about integrity verification: maven does this too if you pass the `-C` flag.

One of the mayor benefits of maven/cargo repositories is that they are configured to be immutable. No issues with deleted repos or deleted/overwritten tags. Once your dependency is published it's there forever.