Comment by skybrian

I knew that Go had a checksum database but not that it had a tamper-proof log. This seems like something that other package management systems should do as well.