No worries. Feel free to popularize it. I’m more worried about supply chain security than credit :).

Also rather than a UUID a hash of the package name is probably sufficient for back compat and avoiding people trying to rotate UUIDs to get sooner / later distribution.