I remember similar distributed repository discussion in some desktop distro (Ubuntu/Debian ?). A good point was made that you are actually indirectly telling the swarm that you have outdated libraries. An attacker just needs to wait for an update for a remote exploit to come down & all the swarm participants that are requesting it before they manage to install it. So this would have to be addressed somehow.

Still, a trusted central repository just doesn't have this issue.