Comment by sesm

I think malware check should be opt-in for package authors, but provide some kind of 'verified' badge to the package.

Edit: typo