Package validation (using a checksum or signature) is definitely on our radar. We just haven't gotten around to it yet.