Security concerns can be dealt with via the pre-existing public/private key crypto that's going on in apt already.
The problem with torrents is they don't work well for lots and lots of (relatively) small "file groups" where each user has a lot of the files, but each user has completely different files. Something based on tiger tree hashing or some other mechanism like that might be more suitable, perhaps?