I've often thought that it's a key weakness when packages are maintained by a sole dev at a single location. Doesn't Debian (and other distros) kinda get aroun

I've often thought that it's a key weakness when packages are maintained by a sole dev at a single location. Doesn't Debian (and other distros) kinda get around this by having packages built from multiple source repositories as redundancy? When you select an apt mirror you're also selecting an entirely different build right? If "digital twins" are maintained at unconnected sites with identical build paths, won't we be able to have package managers do a diff/hash comparison of packages to reveal if one has been tampered with? (Maybe apt-get already does that, but I am not sure). Is the main objection to this that keeping them all "in sync" would be prohibitively complex for a lone maintainer? Doesn't that suggest that developers are better off building relationships with a distro team as early as possible in their application's lifecycle - rather than distros just randomly "pulling in" things the feel like including?