While this is a logistical problem and people generally don't check code in the dependency tree, I already fear the security mechanisms that might spawn from this.