Except that a huge chunk of the Rust language sits in crates on the Internet that nobody is willing to sign and vouch. Proc macros pull in a bunch of dependenc

Except that a huge chunk of the Rust language sits in crates on the Internet that nobody is willing to sign and vouch. Proc macros pull in a bunch of dependencies that pretty much exist in every single Rust program. Serde might as well be in the Rust language as the Orphan Rule prevents anything else from being anywhere near as effective now that it has momentum. Those entire trees of dependencies should be signed and vouched by Rust itself as they are effectively part of the language. And, yet, they aren't. Rust has enough adoption at this point that they should probably switch to something like Maven's repository where you have to have domain control and a PGP key to release things. It would also solve the problem of namespace squatters.