If you are going to build a package manager, can I humbly suggest to take the learnings of late and use a DHT + strong signing of every package?<p>This practice of forever chaining a language to a bunch of fragile servers out there that go bad at the rate of links is worrying.