Fair (and you’re basically describing the xz hack; vouching is done for online identities and not the people behind them).

Even with that risk I think a reputation based WoT is preferable to most alternatives. Put another way: in the current Wild West, there’s no way to identify, or track, or impose opportunity costs on transacting with (committing or using commits by) “Epstein but in code”.