If WordPress users are going to start using mirrors then WordPress needs to add and support package signing. Otherwise we've added another way to backdoor WordPress sites, using a malicious mirror.
Though still limiting as you can only checksum files after plugin installation. You probably need a staging WordPress install to verify mirror plugins before rolling out for production usage