Security should always a be a core focus area! This isn't a minor thing.

Linux distributions have been doing this for ages, and I can remember when a distro or two got caught sending infected updates.