I would want to think it over but off the top of my head: GitHub could provide this as a service, perhaps using uploads of whatever state/national ID the user

I would want to think it over but off the top of my head: GitHub could provide this as a service, perhaps using uploads of whatever state/national ID the user is coming from. Give a little 'verified ID' badge. All banks do things like this for new accounts. Granted this doesn't stop state-actors, but it should be effective against cyber criminals. I think a system where it was harder for unknowns/newcomers to contribute but had better security is a good tradeoff. Esp. since it is likely this incident is not unique.