If the CVE pipeline has decided to blindly trust anyone who puts information into their system, then the only sustainable system is for the downstream processes

If the CVE pipeline has decided to blindly trust anyone who puts information into their system, then the only sustainable system is for the downstream processes to do the same thing. The solution therefore is to blindly accept any PRs from white knights that show up around the same time an obscure edge case CVE is reported. As the CVE reporting process teaches us, always accept unauthenticated input as valid without regard to how this impacts other people's lives.