In reply to David Anderson.

Unfortunately, that is true. But with a single compromised user, WordPress.org maintainers could very easily revert those bad commits. I am following the proposal of Otto here, that he expressed when critiquing Ship. It is not a perfect solution, but in my opinion - a much better than storing a lot of plain text passwords for all the user's.
I wish WordPress.org had a better (or any, for that matter) API to handle those things, but I have no better solution for now. And I am open to suggestions :-)