You could do it with enough people that there is several sections overlapping between unrelated people that it becomes infeasible even for state actors to compromise EVERY person attesting any one piece of software