As far as I can see, the article is somewhat about whether we can trust open source software, given political tensions, language barriers, and malicious actors.

As far as I can see, the article is somewhat about whether we can trust open source software, given political tensions, language barriers, and malicious actors. To that, the article suggests a central authority with global membership to create trust. If the W3C is representative of that, then regulatory capture is a real possibility, or balkanisation if there is disagreement. Trust in balkanised orgs is of course a problem, and hence trust in the code - the paper deals with a similar issue ie. How to trust code. In this case though, the idea is to be able to verify the code yourself, rather than trust an org. The paper centres on whether you can trust the compiler ie. The bootstrap problem, and while tech alone will never solve the issue, the capability to create trust in the code yourself can be a basis for better layered trust on top. To add to this, signed builds/source on their own are not a solution as a compiler or malicious actor can inject bad code. As such, yes I don't believe a central, or federated orgs alone can be a solution, you're likely to need a solid bootstrap and chain of trust (and maybe content-addressed code) to underpin the quality of the code.