Could the XZ backdoor been detected with better Git/Deb packaging practices?