Doesn't really even need to reduce average developer friction - they've proven a few times that they're happy to add extra security requirements just for publis

Doesn't really even need to reduce average developer friction - they've proven a few times that they're happy to add extra security requirements just for publishers of high-visibility packages. "Once you cross 100,000 weekly downloads, all new publishes must be signed" would keep the easy on-ramp for small packages but dramatically reduce the risk of major attacks against all the big targets (like the example here). Not as good as signing everything, but a good start that can be iterated on later.