Everyone can make a commit, but it's the merging that's key here. We don't know who has merge access, right? That would be something we should know. Just like with Bitcoin Core, we know who the maintainers are, we should be able to see who the maintainers are with Nostr.