It's just whitelisting with some minimum web of trust. Anyone can do that. Or maybe we don't even need that at all. It can all happen on the client with events coming from any relay.