[libre-riscv-dev] web-of-trust for code reviews to manage trusting dependencies

[Jacob Lifshay]

One other part that's different than Debian is crev is designed to be
mostly independent of the actual method of publishing the code that is
being reviewed. This allows adding web-of-trust based code reviews to
be done and can handle cases such as someone compromising an account
and publishing their malicious code, since all that's needed is for
someone who you transitively trust to review the code and find it to
be malicious.