The conclusion is especially bad.
"we'll get a solution where the end user has the relationship with the source of trust and not the package author."
That's extremely dumb, on many levels. I'll go with the possible most disturbing.
If you don't care about the author and only the source, the author just has to put a backdoor in the code. DONE.
That's why you have to trust the author and NOT the source. The author is the first creator of the code and thus the person with the most ability to sign the code.
Package signing ensure the package has not been modified (because you see, replacing SHA hashes is trivial. sha1sum file > thehashfile.txt).
Yes, you'll have to trust someone, at some point. Then you'll build more trust as time goes. That's how it is. When you get your debian package, you trust the debian devs, a bunch of them. When you trust a arch package, you trust that the devs you trusts make good trust decisions, and you trust them as well (arch uses the "web of trust").
When you trust an SSL server, you trust that your browser made the right trust decisions, and that the CA made the proper checks, and that the server owner is trustable.
When you turn on your computer you trust that intel didn't backdoor their microcode.
And so on. Trust is an infinite "issue" and securing the transport will never ensure the source is correct. Never.