in the end this boils down to the issue of naming and trust, isn’t it?

who says plugin xyz is the one I want and is not confused with another one that is called xyz?
we still did not solve this in a usable and scalable way, did we?