Is there advice on how to securely update Pip without running an older version of Pip that’s vulnerable to MitM attacks?