[ramses0]

Debian has regular key-signing parties, bit-for-bit gpg-signed reproducible builds, human vetting before access / upload is allowed.

https://www.debian.org/devel/join/nm-step3

https://www.debian.org/devel/join/nm-step7