Adding the extra information is a great idea...we have our own little repository / update system, and with a different "home", different sites could, for instance, keep different distributions up to date.

HOWEVER, the phone home and XML-RPC stuff makes me *very* nervous from a security perspective. I would want to have some real hard core folks examine and document information flow end to end and looking for vulnerabilities -- ideally some external folks as well. We will need to review all Drupal.org processes as well as the receiving code.

There has been other talk about auto-downloading various information. Same comment there -- huge security risk, needs 100x as much review, and even then I'm nervous about it....