Dependabot should sign it's PRs with a gpg signature. And web interface could get support to check those signatures. That is way more trustworthy than a random

Dependabot should sign it's PRs with a gpg signature. And web interface could get support to check those signatures. That is way more trustworthy than a random green flag in some web ui that changes all the time.