For open contribution projects, you can't use this because it's trivial to slip in something malicious. For projects with trusted contributors only, PRs are us

For open contribution projects, you can't use this because it's trivial to slip in something malicious. For projects with trusted contributors only, PRs are usually approvable anyway, a one bit blackbox signal telling you some of them are (with zero explanation, it seems?) isn't very valuable. Not sure why you would use this.