I have a similar thought. WoT relies upon authentication. How does Crev do authentication? What methods are used for key revocation, etc? It didn't seem to me that they were tackling that directly but relying on a proper use of underlying technology. Possibly I'm wrong or possibly they haven't got that far, but I'd love to see a more explicit description of exactly what they've thought out so far.

Who would trust those?

Then the question becomes, how do you know who to trust ? Are you supposed to also vet the id-hashes of the signers ?

I guess you will trust coworkers, people you know irl, well known developers, companies you pay for review subscriptions. You don't have to trust all of them 100%if you require multiple reviews per dependency.