Implicit trust is easy to solve by forbidding it. If someone doesn't want to maintain his project anymore, someone else could make a fork and try to promote it

Implicit trust is easy to solve by forbidding it. If someone doesn't want to maintain his project anymore, someone else could make a fork and try to promote it and try to gain trust again, but not take over that project. While this particular problem can be solved, in reality it doesn't matter, because trusting third parties with all the poor security they have is a much bigger security hole.