Alternatively, I feel much better when the upstream vendor is the one packaging and signing the software I install, instead of a (possibly malicious) volunteer

Alternatively, I feel much better when the upstream vendor is the one packaging and signing the software I install, instead of a (possibly malicious) volunteer from my distro's repository team.