Done: "Let's add a delay so malware can be discovered while many haven't installed it yet"
Next up: "Everyone uses the delay now so nobody finds the malware"
Then: "Let's assign people to take a look at packages during the delay phase"
Then: "Our reviewers can't keep up so malware still slips through. Let's replace the time-based delay with a flag reviewers need to set once they're done."