I've come across a few cases lately where a package on NuGet has a name that starts with "Microsoft" but is actually uploaded by someone else. Take Microsoft.TestApi for example. Ostensibly this is a NuGet wrapper around the TestAPI project on CodePlex. The CodePlex project is from Microsoft as there are blog posts hosted on a Microsoft domain talking in great detail about the project and containing direct links to the CodePlex site. So I'm comfortable that downloading the package from there is safe.
However, the team who made the CodePlex project have not created a NuGet wrapper. Someone else has gone ahead and created one, which has gained some traction - 15k downloads at the time of writing. The owner is a personal account, in contrast to the clearly official Microsoft one used for other Microsoft packages. So far the only evidence I have for the provenance of the TestAPI package is a conversation on CodePlex where the owner of the original package looks like they are an acquaintance of the person who uploaded the NuGet one.
I feel like the above security credential is weak, and I am therefore minded to obtain the source directly from CodePlex. I would rather get it from NuGet though as then it is consistent with all my other packages. Have I missed something in NuGet's validation process? Maybe there is a signing process where it does not matter who uploads it because the package is securely signed and versioned previously?