Comment by DavidEGrayson

For what it's worth, pacman does support GPG signature verification, HTTPS, and SHA-256 checksums. There is a GitHub user right now making a bunch of pull requests to MSYS2 to make our PKGBUILD scripts more secure, mostly by using HTTPS and SHA-256 whenever possible.