Comment by oneshtein

So only people capable of auditing source code and build scripts are able to be maintainers of opensource packages for others.