Hack into the system holding a trusted repository, and swap in your variant with same signature?