Less central repo, and more signed packages. I don’t care where my packages come from, I just care that they’re signed and verified on the client. I can use any mirror I want, including the one I self-host, and I’ll get the same result. Then the problem changes to making sure your mirror is in sync, and that shouldn’t be that hard.