Hacker News Reader

You'd probably still want a centralized repo of checksums, otherwise it may be more difficult to verify the authenticity of the packages

That still wouldn't guarantee that the package contents isn't malicious