Re: You wouldn't get into a stranger's car
"You should never simply connect willy-nilly to a server you don't trust anyway"
I do regularly, so do most people here. You do too, probably.
Mirrors. Software distributions, patch files, src files, distributed on potentially untrusted mirrors - often a mirror is chosen automatically based on geographic position / load.
But the software is protected by cryptographic checksums kept either locally, or on the main, trusted server.