That still isn't decentralization: There may be a bunch of mirrors, but there is still a single "source of truth". One entity determines what is acceptable and

That still isn't decentralization: There may be a bunch of mirrors, but there is still a single "source of truth". One entity determines what is acceptable and valid in a repository model, as the entire ability to trust packages you install tends to be on the assumption that entity is making good choices.