I don't see it as "transferred risk". As individuals we already have people we trust and people we don't know. This system allows you to get trust in your depen

I don't see it as "transferred risk". As individuals we already have people we trust and people we don't know. This system allows you to get trust in your dependencies without requiring to trust the specific rando that authored the specific library you want to use. Yes ultimately someone you trust has to vouch for the library for you to trust it. That's unavoidable either way. Those systems only allow for that person to be anyone instead of just the author.