Am I too paranoid or was this the plan all along?

There are currently a lot of people auditing source code with AI. Wouldn’t it make sense to publish the results as some kind of nostr event? It could tie a specific source code version to a code review, signed by the author and allow discovery with web of trust. This should obviously not be used to publish CVEs but be more for a positive indication.