Pip is separate from python itself. With a given language can I download packages with curl and install them myself? I think I can trust curl.

The problem is not only that the tool connects to the networks, but who is behind the tool. Google is a company whose business is collecting all the information on people it can. I don't think those in control of python/pip have the same incentives.