I'm unsure on how you could do what you've said without encryption. Any ideas?
It doesn't have to be encrypted to be trusted. In fact, anyone can set up a separate mirror and clients can use it with no concern about safety.
It doesn't offer confidentiality, but it does offer integrity.