Recommend package manager hardening

anonymous595: > Why: http is insecure and can be tampered super trivially. I think most distros sign their packages and enforce verification checks so https isn’t so important, but it could be good for some added privacy.