Probably broken, since a competent attacker would have been able to avoid creating a checksum mismatch.

My company's actually done the same thing before (same error), by putting Cloudfront in front of our APT repo -- it cached the main packages file inappropriately, causing the checksum mismatch.