How hard is it to build a trust network system for these packages?