Browser extension stores should be more transparent about open source and licensing. And probably they should collaborate with CI providers - eg. make contract

Browser extension stores should be more transparent about open source and licensing. And probably they should collaborate with CI providers - eg. make contract with GitHub to sign artifacts with "these files were built using following pipeline from commit XYZ in repository JohnSmith/UserBase".