Rely on distro maintainers for package security, not developers

blogs.gentoo.org