I don&#x27;t think it&#x27;s necessarily true, I remember Linus saying that for Linux&#x27; kernel they used a web of trust. At one point you had to trust some people, you can&#x27;t watch every updates. And he said something along the line &quot;if you&#x27;re not doing cryptography&#x2F;security like this, you&#x27;re doing it wrong&quot;