The solution for that would be to subscribe to specific repositories, similar to how Debian does it for example. Anyway, even if they just let people to manuall

The solution for that would be to subscribe to specific repositories, similar to how Debian does it for example. Anyway, even if they just let people to manually download and install unsigned extensions the risk would only fall on the people who chose to do that. These that wish to do so could still continue and use google's walled garden.