How about a foundation to run the package repository (for independence), a requirement for multiple sign offs to publish an artefact, and a requirement that suc

How about a foundation to run the package repository (for independence), a requirement for multiple sign offs to publish an artefact, and a requirement that successor maintainers exist? Yes, this would create a barrier to entry, but I’m not sure that’s a bad thing.