It doesn't have to be encrypted to be trusted. In fact, anyone can set up a separate mirror and clients can use it with no concern about safety.
It doesn't offer confidentiality, but it does offer integrity.