That's a different problem to where the packages are hosted. You can host your own packages and get added to an official aggregator. Said aggregator can functio

That's a different problem to where the packages are hosted. You can host your own packages and get added to an official aggregator. Said aggregator can function as an automatic verification system to assure people that your software is not compromised, has been updated recently, etc.