The "Date, Valid-Until" timestamp mitigates replay-attack, cool. But what if a vulnerability is discovered in a package and an MITM attack prevent you from downloading the new patched version, making you believe your system is up to date although it's not ?