Towards better dependency security

In light of the arrayref incident, it's probably a good idea to try to think about dependency security differently. It's often complained that this is due to missing feature in cargo, for example, crate namespaces. But we actually kind of already have everything we need: custom registry. And a design based on that already works mostly hassle free. The core idea is: use custom registries to represent trust boundaries. The default crates-io registry is disabled. And everything works on custom ...