Yes I'm well aware of what open source is and how it works (if you notice I'm pretty active on github); I've already sent a PR to fix part of the problem before

Yes I'm well aware of what open source is and how it works (if you notice I'm pretty active on github); I've already sent a PR to fix part of the problem before. However, it makes very little sense for them to, for example, merge a PR if it uses my public key for verification and not theirs. The problem I'm running into is that I can't just fix the issue without their cooperation. Regardless, this is all moot because the Composer maintainer is now communicating with me privately to discuss how to fix the problem so it will be solved some day soon.