"Outside of the web you're trusting your repo and that's it."
But still trusting, and thanks for proving my point - people do not typically audit the software that they install on their computer, even though they can. I have to admit that even I didn't audit every program I got. Don't get me wrong: It's still a problem, just not a problem that is somehow limited to the web which is how the original argument was framed. It's a problem period.
