handle conflicting mirrors/repos

I think it's currently possible to add conflicting mirrors/repos to the client. Here's an example:

• Offline user adds a repository form a flash drive. Let's say a local mirror of the guardian project repo.
• The repo wasn't previously added, so fdroidclient adds it as a new repo, with the flash-drive as a local mirror. (Still need to confirm it that's what really happens)
• What the app doesn't know is that the repo was tampered and signed by a third party.
• The app eventually gets a chance to connect to the internet and starts an index-update from online repo
• The index update will fail because the signature seems bad.

Should fdroidclient try to help users resolve such a situation?

(In my opinion this is also pretty unlikely because such a tampered repository would likely also have a tampered web address)