Maybe the principal maintainer can be trusted, but pull requests could do with some of that evidence.