Trust is only useful when people can act on it. That is the point of tea. The open-source graph needs better ways to understand source context: who stands behind a project, what it depends on, what claims exist around it, and how support or governance should move through the system. GPG key verif