It'd be nice if there was a way to have ansible-pull verify GPG signatures (like some puppet setup people use). That way, it doesn't matter as much if AWX gets compromised.