Hmm, review and certification of open-source packages could likely be a business. Something similar to commercial Linux distributions, like RHEL, that test and vet their packages, but not limited to that.