Consider review and approval process

[tmpfs]

To establish trust in a package anybody could download the package, review it's contents and sign the package bytes to signal approval of the package.

Packages with lots of approvals would indicate a significant level of trust.

Approvals could signify either:

• Package was used as a dependency and no problems were encountered
• Package was peer reviewed