This doesn't bode well with the charm store policy. There's no cryptographic verification of the compser package. We require at a minimum to fetch resources over SSL, with a preference of having payloads validated with signatures or hashsums.