Does quicklisp not perform any verification of downloads? Skimming the source code I see no indication that it does any checksumming or cryptographic verification and it appears to download everything over http.
Right on both counts. It is not good. I hope to fix it.