First things first: The Missing Link!
Dmitry Bogatov (maintainer for several Debian packages and a TOR exit node) was arrested in Moscow, accused of endorsing violence and mayhem. The Debian project reacted by - besides giving their moral support - revoking access rights based on his private key as a precaution, in case the key gets compromised.
(Score: 2) by butthurt on Thursday April 20 2017, @08:53AM
> source code coming from shar archives on usenet or rando ftp sites
If it's been read by someone competent in the language, that can mitigate the fact that it changed hands in an insecure way. Not to say that the Debian maintainers necessarily do such auditing.