@whitequark That's a great point. I've delegated my trust of thousands of packages to debian because it's much easier than making the thousands of trust decisions myself, which would obviously be impossible.
Which OS are you yourself using today to best incorporate the issues in "reflections on trusting trust"? Previously the smaller package numbers in bsd have discouraged me but that seems to be a winning feature now. As soon as I get to a bsd desktop I'll try out chipass!