Trust issues can often be mitigated with verifiable signatures. Perhaps if there was a protocol in place requiring each release to be signed by the current main

Trust issues can often be mitigated with verifiable signatures. Perhaps if there was a protocol in place requiring each release to be signed by the current maintainer and all commits signed by the individual contributors, then a change in signature on the release would have provided a strong downstream signal that maintenance had changed hands. Without verifiable signatures, downstream is drinking the water without testing it. As you said, there are crazies out there, who knows what they might put in the water.