[awalton]

> platform-neutral tool that's been independently audited and managed by my OS's package manager

Your OS's package manager is simply wrapping up whoever else's software in a nice pretty bow and releasing it. The only veracity it has is that the person who put the bow on it signed it. It's highly unlikely they did any kind of "independent auditing" or managing beyond writing some script to build the software.

Or worse: if Debian is an example, they'll say "I don't understand this code, therefore it's not useful", comment it out, and ship horribly broken software to you.

At the end of the day, you have to trust someone. Whether you trust keybase.io or not is entirely up to you - liz setup an incredibly tedious blog post to basically say just this.

[rlpb]

Part of what distribution-managed trust establishes is that it puts all distribution users (of that particular distribution) in the same boat. This is incredibly useful for verification purposes.

If I cared, I could even cross-verify across distributions by comparing their source tarballs.

> Or worse: if Debian is an example, they'll say "I don't understand this code, therefore it's not useful", comment it out, and ship horribly broken software to you.

The other point of view: they fix software so that it is useful, and I can easily have an integrated system. For the one problem you point out, there are hundreds (or probably even thousands) of useful integration patches that distribution users take advantage of every day, without even realizing it (and those suitable for upstream projects generally get pushed that way, too).

If you don't like distributions, then don't use them. And have fun with that.