If the maintainer has 10 people they 99% trust, and they seem unlikely to collaborate, and they all have builds with identical SHA-256 sums, that's much better

If the maintainer has 10 people they 99% trust, and they seem unlikely to collaborate, and they all have builds with identical SHA-256 sums, that's much better than picking one build from one of those people.