For example, do they check a digital signature (like apt-get and Windows Update) or can they be required to use SSL? If not, I'm a bit concerned that the downloaded packages could be trojaned..
All Python packages are not hosted on pypi.python.org, but easy_install will look the PyPi page for download links. Many common packages like PIL and lxml use their own distribution server (which in fact often causes issues for package consumers). Example: http://pypi.python.org/pypi/PIL/
pypi.python.org itself does not seem to offer HTTPS support of any kind.
If you wish to provide secure easy_install / pip environment I suggest you mirror required packages to a server where you maintain HTTPS yourself and then restrict downloads to this server using
It seems easy_install does some validation, but it seems it only checks if the package repository supplies the MD5 key.
The future plans section of the same page further hilights this: