It'd be even better if CPAN even allowed a "default trust" model that has been so successful on the internet. I'd flag all of my modules as "default trust" so anybody who felt like I wasn't doing a good enough job of maintaining my module could upload a new version.

Add to that various time-outs so if I never respond to new uploads then those who do the work of uploading can get ownership power over the module name(s).

Heck, let me set the time-outs. How long before a non-author upload becomes official and gets indexed. How long after I upload a new version of a module (or even "refresh" a module as "still up-to-date") before non-author uploads can become official and get fully indexed. How long before a new uploader is automatically declared an authorized maintainer (and thus can set their own time-outs or approve others' uploads).

If I don't configure a specific time-out for a module, then that time-out wouldn't apply to it (CPAN would behave as it does now -- valuing ownership far above contribution and discouraging collaboration).

Though, I'd prefer to require a new version be uploaded and not allow an empty declaration of "still up-to-date". But I suspect allowing the latter would be more successful, at least at first.