So cargo-crev is effectively such a distro, but also tackles the next questions: how do you find maintainers? How do you find maintainers you can trust? The ans

So cargo-crev is effectively such a distro, but also tackles the next questions: how do you find maintainers? How do you find maintainers you can trust? The answers are: anybody can review and approve packages, but you select a trustworthy subset through a web of trust. And you can adjust trust requirements to be anything between "better than nothing" and "full paranoid". A traditional distro is a central authority, with fixed policies, and they don't have to agree with you which packages are worth including and what level of scrutiny they get. If you want something that's not a part of the distro, you're on your own. With the crev system you can organize or sponsor reviews of any packages you want. There can be multiple sets of approved packages, and you can decide yourself whether e.g. packages approved by an NSA employee are checked for good cryptography, or an evil govt backdoor.