I noticed in the process list, fapm was using apt-get with --allow-unauthenticated option. IMO, it should at least warn, or user should be able to set in the options not to install unauthenticated and unverified packages. How about overall, if (authenticated) packages are installed with fapm, does it check them against repository's signatures, or does it just download them and install them blindly then with dpkg -i ?