That's actually kinda funny because at first I couldn't think of a single reason why that doesn't solve exactly the same problem. I guess you can't prove who i

That's actually kinda funny because at first I couldn't think of a single reason why that doesn't solve exactly the same problem. I guess you can't prove who is 'in control' of the repo - the author could have sold the key privately and there's no way to tell if they sold it to multiple new owners. Kinda like art in the 'real world' - you can 'prove' its the original but no way to tell whos hands its changed through over the years.