Seems like this would mostly raise suspicion for little gain, wasn't there a more robust solution of signed distributed reviews so you could simply pin the depe

Seems like this would mostly raise suspicion for little gain, wasn't there a more robust solution of signed distributed reviews so you could simply pin the dependency at a state where reviewers you've explicitly added as trusted review code (and similarly after you review you can express that for the others to rely on) Of course, this won't magically increase the time spent on code review, but will at least allow currently internal reviews to be available