Rust has an effort going on (by a single unaffiliated person) to have a trust chain sort of thing per version. Cargo-cred.

I hope others copy this. This is truly scary.