"decentralized package management" is a security dumpster fire. I want well-known Linux distributions to review and vet libraries - as they do - so that I don'

"decentralized package management" is a security dumpster fire. I want well-known Linux distributions to review and vet libraries - as they do - so that I don't have to trust some random libraries from random author hosted on random VCS services.