To achieve decentralization, we need a better model of trust for OSS at Github scale. If there was a way to verify the authenticity of packages, we could even u

To achieve decentralization, we need a better model of trust for OSS at Github scale. If there was a way to verify the authenticity of packages, we could even use existing centralized repositories. I've been tinkering on an approach to this at https://github.com/chromakode/signet https://github.com/chromakode/signet as a proof of concept.