You would, but that doesn't help you until someone figures out that it is malicious. This lets you track who has actually verified that the package is not malicious.