@rballard and me discussed the opt-in part of this proposal and came to the following observations:
- It is true that strictly speaking there is no difference between binary and source dependencies in terms of trust, as some folks on this thread also commented. This makes a per binary packages opt-in during development time less important
- The difference between having zero vs. any binary dependencies is still significant, for example it will be harder to port the package to a new platform if there are any binary dependencies. Because of this, it would make sense to offer package authors a way to opt-out of binary packages wholesale in order to not add a transitive dependency on one accidentally. It warrants further discussion to figure out whether this is better suited to manifest API or a separate configuration option. There might also be a case to be made to make developers opt-in to binary packages once instead.
- Increasing the visibility of binary packages being used is still a worthwhile problem to solve, but it can be tackled as a workflow feature by tools built on top off libSwiftPM and doesn't have to be part of this proposal.