I think that as well as having something like Crev for distributed code reviews / audits, it makes sense to have some sort of Web Of Trust system for letting en

I think that as well as having something like Crev for distributed code reviews / audits, it makes sense to have some sort of Web Of Trust system for letting entities say who they trust (and how much they trust them). There's a big difference between some unknown anonymous person being one of 100 contributors to an important free software package (and their work being signed off by two lead developers), and this unknown anonymous person suddenly taking over complete ownership of a package that they've bought off a burnt-out developer. It should be possible to programmatically distinguish those two cases without even having to abandon the idea that people can contribute to free software anonymously, but the process for someone to bootstrap a certain level of trust might be difficult without more of a culture of mentorship, or businesses adopting the process of cryptographically vouching for their employees (and not revoking that vouching when the employees change job).