Indeed, it would need to be more specific, and say this list of people in this repo.

Uh yes of course, I thought of that and thought "isn't that neat" but of course it goes against exactly what the author wants. I don't find this fear very natural I suppose! A different trusted third party could be nominated, I guess (KDE project nominate KDE e.V. for instance).