You are right it's exactly the combination of ongoing snapshots and the need to only provide access when there's a verified release event. We try to provide that balance.

We also do verification, but that's mainly when there is 'less than optimal' trust between the developer and the licensee.