If only there was a way to sign software and not depend on a centralized authority, something like a... web of trust?

(and yes I know, you'd need to have the option to have "your" (haha...) OS trust it of course)