Just piggybacking on this comment, you can do a whole lot more than just trust that a few people have automated. Most people in Ubuntu get non-distro packages f

Just piggybacking on this comment, you can do a whole lot more than just trust that a few people have automated. Most people in Ubuntu get non-distro packages from Launchpad, for example, which uses their own build servers. With reproducible builds you can require BOTH launchpad and the developer's signature for a package to be valid, which tremendously improves the security situation.