Package triage; vendor documentation

[mkevenaar]

I want to take over/help with package maintenance for my software

Based on the documentation, the site-admins should add the user to the package, no questions asked

I think the site-admins should verify that the sender is actually the vendor of the software.

[pauby]

Agreed. I don't think we should be too detailed on how it's verified (I just see that asking for problems later) but we need to make sure it's clear.