i wasn't talking about git:// urls and i think that removing them was probably a good idea, for the reasons you describe, but also because they didn't have any way to stymie mitm attacks

but it seems like my original comment was incorrect in a couple of different important ways, and i appreciate people having pointed that out