I think the best solution would be governments forcing companies to secure the entire pipeline and setting up a non profit that does this for open source packag

I think the best solution would be governments forcing companies to secure the entire pipeline and setting up a non profit that does this for open source packages. Have security researchers work for a non profit and force companies that use software from some guy in Nebraska to pay into the non profit (could be in the form of labor) to get the code checked and certified. The guy in Nebraska is still not getting anything but will also not have the stress of becoming one of the main characters/victims in a huge attack.