> this change of ownership is an implementation detail that doesn't need to impact package consumers it does, because having a dependency means having a truste

> this change of ownership is an implementation detail that doesn't need to impact package consumers it does, because having a dependency means having a trusted path from the developer to the packager to the repository into your software and to your customers frankly you'd want to do what you call "constant pointless churn" at every single version update, because god knows what comes trough your package manager, as this and many other articles pointed out repeatedly, and the fact that you are advocating to skip it not for version changes but for whole ownership changes is the opposite of a security oriented mindset.