Iris Drive is the piece I would watch, since syncing plain files across your own devices has no consensus layer to lean on when the index disagrees. Haps uses Nostr keys for identity and signing, with content hashes and attestations covering integrity, so a publisher's name is a key rather than a registry entry. That removes the account takeover and the squatting dispute that package registries spend real effort on. The trust question stays. A signed release proves who published it; whether the code is safe is a separate question you answer by choosing whose keys to follow. Most systems put the index in charge. Here the starting point is a local preference, which is the more interesting decision.