You're right about the security aspect, which is what Microsoft says OneGet will also attempt to resolve (in effect, replacing chocolatey's repo with theirs, I'd assume).