Secure method for fetching freebsd sources ?

[Angelin Lalev]

Greetings,

Which is the *secure* way of fetching freebsd sources?
Cvsup looks prone to MiM attacks, CTM looks promising, but only if I
have been member of the appropriate ctm list since the release of 8.0.
(it seems that the ctm deltas on the ftp are not signed.).
Do FreeBSD cvs servers support ssh instead of rsh access as OpenBSD server do?
Other alternatives?

Please note that this is not a theoretical question. I really have a
system which i'll put in a place I don't trust, so I'll try to encrypt
everything from the disk to the connections which I will use for
updating.