Honesty boxes work with honest players. If they have to reject good code until they can trust the submitter, I'd be fine. Trust is human, and takes years, decades even, to be made.

Supply chain attack is knocking on the door. Maybe less people should work on OS kernels not more?