And then they become distrusted and BOOM trust goes away from every project that subscribed to the same source.

Think of this like a spam filter, not a "I met this person live and we signed each other's PGP keys" -level of trust.

It's not there to prevent long-con supply chain attacks by state level actors, it's there to keep Mr Slopinator 9000 from creating thousands of overly verbose useless pull requests on projects.