2nd paragraph of blogpost:

> A hash of all files is checked against known hashes on sum.golang.org to prevent tags from being replaced, and it uses a proxy to prevent repos from being left-pad’d.

there is no need for 3rd party hosts to stay online. It's the best combination of de-centralized and centralized approaches.

Re pre-buiild packages: Python makes a difference between source and binary wheels. This approach is obviously for source wheels only.