Seems like you could address with a super-crate that includes "trusted" crate releases as "features" That crate could involve some automation like: * Checking

Seems like you could address with a super-crate that includes "trusted" crate releases as "features" That crate could involve some automation like: * Checking that the code in the crate matches the code in Github * Checking whether the latest commit is from a new committer, or whether there is any code comitted by a user not in a whitelist, * Checking whether the package has any known security advisories * Checking that crate signatures match some whitelist * Running a project that includes the crate in a sandbox and seeing whether there are any files accessed, network accesses, etc. that were not pre-whitelisted New versions of included crates would have to go through this battery of checks before they get bumped in the super-crate. Crates that want to be included as features of super-crate or that need to change/add significant functionality, or add dependencies, would need to make a PR to update the relevant whitelists, which could then be reviewed by the super-crate team