>How are you going to update if apt is compromised?

Download the package with your http client of choice, install with sudo dpkg --verify -i