It just wasn’t my day, and we put a lot of effort into it, so being told that I said it does not matter kind of set me off a bit.
Anyway, lock files and package integrity verification have been pushed, there may still be a few details to iron out, but it seems to be working so far. Let me know if you find something that looks wrong or if you think about anything that is missing.

Removed by mod

Absolutely, there are preliminary work on package integrity verification it’s simply non-food paying work as you can imagine but it will be committed anytime soon.
I know lock files are done by now, it will just take few more changes to have package integrity verification aswell.
We just didn’t expect people to want a full-featured package manager right away, but it’s going to happen.
Thank you for these wise advices, and again, you’re more than welcome to join if you find time!

What prevents bad actors from changing stuff under the hood?

You’d have to hack into the asset store and upload another zip archive there to update the official registry, I guess 😄

verifying via checksum could be helpful here

Indeed, lock files and checksums are planned
It’s still in early development and if you can help with any of this please suggest changes on the repo

Also if you’re into decentralization you can own your manifest