I don't know the solution. If some dev goes rouge even your WoT is only able to tell you "i have this version too" is there a way to signal fraud? what if someone from WoT signals it wrong?