Tap trust is nice but I bet most people will just blindly trust everything anyway. Like we do with every other package manager.