Sigh. I know. Most people argue the trade offs. "Wouldn't you rather have software that's risky and poorly distributed than none at all?" Or something to that effect, maybe with less verbosity. I still love the Obtainium model though. Like let me get the package from the maintainers github, website, ftp site etc. Albeit id prefer more verification... Some maintainers _do_ care about secure supply chains. And even the repeatable build from source argument is a loss imo. My projects can take anywhere from 5-25 minutes to build from source with powerful processors.