Ultimately, it seems like decentralized repositories will be the best long term solution. Apparently, establishing new code-signing and merging protocols will take some time and effort, so I wonder if it makes sense to adopt a centralized replacement in the meantime. It sounds like it's not an urgent issue.