> That solution implies we have to move toward zero-trust architectures even within open communities

Zero trust cannot exist as long as you interact with the real world. The problem wasn't trust per se, but blind trust.

The answer isn't to eschew trust (because you can't) but to organize it with social structures, like what people did with “chain of trust” certificates back then before it became commoditized by commercial providers and cloud giants.