The packages are independently verifiable, and cacheable. Do you could start your own cache with a Raspberry Pi at home if you wanted, and if whatever browsers you trust implemented this check you’d have your own secure version of it.