Our current physics of trust requires you to trust everyone the developer trusts.

The developer makes decisions of others to trust, based on what dependencies to take on.

You're not just trusting the developer, you're trusting everyone the developer trusted…

…and everyone they trusted, and on and on ad infinitum.

All it takes is a single weak link to break the chain.

What is the chance that every single link in the chain is not weak?