That is still checked for its signature, the only thing you bypass is the automatic download over HTTP and dependency resolution by default.