In the abstract, what I'm wishing for is definitely possible at least for some subset of packages. • Source code packages are cryptographically signed by at le

In the abstract, what I'm wishing for is definitely possible at least for some subset of packages. • Source code packages are cryptographically signed by at least one and ideally several identities which are verifiable via a web of trust. • Packages are associated with a public repository base URL known to the package manager and that base URL doesn't change without setting off alarm bells. • The source code of a package can be traced back and cryptographically connected to a public commit history at the public repository URL.