It makes little sense to use web-of-trust to verify the identity of the committer and then accept whatever software they publish. GPG's web of trust makes sense because it's meant for communication, where "being from who it says" is the only form of trust that is wanted.
It makes a lot more sense to use web-of-trust to verify that releases are not malicious directly. This is what crev [1] does and I can't wait to see adoption in more package ecosystems.
Trusting yourcolleague42 who trusts that 'left-pad was made by steve' doesn't prevent steve from publishing a malicious release, even if GitHub can check steve's signatures on his releases and commits.
Trusting yourcolleague42 who trusts that 'left-pad 1.2.3 with hash abc1234fde is safe' removes all of the risk.
It makes a lot more sense to use web-of-trust to verify that releases are not malicious directly. This is what crev [1] does and I can't wait to see adoption in more package ecosystems.
Trusting yourcolleague42 who trusts that 'left-pad was made by steve' doesn't prevent steve from publishing a malicious release, even if GitHub can check steve's signatures on his releases and commits.
Trusting yourcolleague42 who trusts that 'left-pad 1.2.3 with hash abc1234fde is safe' removes all of the risk.
[1]: https://github.com/crev-dev