Lazy conclusion. People can and have been validating dependencies. We need an npm proxy with validated dependencies.