They better sign their packages and check for signatures upon download and installation. At their scale, foregoing S3 means they have to figure out how to deal with bit rot in packages themselves.
They're self hosting docs and Zig releases. There is no central package repository. The decentralization (similar to Golang) is one of the things I like about Zig.
