Can I be so bold as to suggest a new feature?

It'd be wonderful, as a package consumer, to have visibility into some security metrics for a given package. This would be useful both at initial install time, and when the package is upgraded. Something like:

1) who are the latest commits GPG signed by?

2) is the package publisher using 2FA?

3) what is the security profile of all dependent packages?

4) are there any new authors (directly or via dependencies) since the last version (with links to the author and their contributions).

These might help avoid prior situations where popular packages get injected with malware by new maintainers.