I think the idea is that a lot of the major package repositories tend to curate what's published (rather than let anyone arbitrarily publish whatever they'd lik

I think the idea is that a lot of the major package repositories tend to curate what's published (rather than let anyone arbitrarily publish whatever they'd like). If I trust the maintainers of the Debian or Fedora or Arch repos or whatever, then the fact that they serve a package means I would trust it more than downloading from some random website I don't know.