> Like, for example, evidence that the author actually takes security issues seriously and has a formal way to announce them.

Personally I think there is a business model in there. "Curated" code releases/versions by a trusted third party you pay to review all the code. It would be a boring job, like being an auditor.

Bonus points, you can pay an "ethical" one that then tries to get money to the OSS devs of libraries that their clients demand the most.