Debian standardized the vetting process for maintainers, validation environments, and shenanigans could be attributed to individual signatures rather quickly.

Debian standardized the vetting process for maintainers, validation environments, and shenanigans could be attributed to individual signatures rather quickly. If you ever want a laugh, one should read what Canonical puts the kids though for the role. One could get a job flying a plane with less paperwork... Authenticated signed packaging is often a slow process, and some people do prefer rapid out-of-band pip/npm/cargo/go until something goes sideways... and no one knows who was responsible (or which machine/user is compromised.) Not really random, but understandably slow given the task of reaching "stable" OS release involves hundreds of projects... =3