Is there any security implication in using the environmentfor security-related configuration (PIP_ALLOW_NO_SSL, PIP_CERT_PATH)? I guess that if an attacker can modify the environment in which pip is run, she can as well change the PYTHONPATH to her hacked version of pip, so maybe it's not a big problem.

Comments?