Requiring it would be wise, or at least requiring it if any other packages depend on it. They're going to destroy the ecosystem if they can't secure it. One maj

Requiring it would be wise, or at least requiring it if any other packages depend on it. They're going to destroy the ecosystem if they can't secure it. One major blow and nobody will trust it anymore.