Agreed! The problem is that the publisher's name isn't always clear: a lot of open source maintainers (myself included) publish major packages under their own n

Agreed! The problem is that the publisher's name isn't always clear: a lot of open source maintainers (myself included) publish major packages under their own name; a less familiar user could easily be confused into choosing the "official looking" name instead. I think the most "complete" solution here needs to involve code signing.