I suddenly thought of this thread when I was in bed last night
And please note that I'm not talking down the current method (submitting scripts via emails) because we all know the advantages of that.
Just out of curiosity, how do you know a person who sends an update for a script is the legitimate person to make updates?
Do you keep track the email addresses used for sending the scripts?