It's not unverified if it comes from an actually curated package repository, like the one on any given Linux distro. "Package maintainer" isn't just obsolete busywork, it's an essential part of a robust security model IMO.