Nostr can fix this. With Blossom.
Discussion
nostr:nprofile1qqs2qzx779ted7af5rt04vzw3l2hpzfgtk0a2pw6t2plaz4d2734vngpzamhxue69uhhyetvv9ujumn0wd68ytnzv9hxgtcppemhxue69uhkummn9ekx7mp0qy2hwumn8ghj7un9d3shjtnyv9kh2uewd9hj7hycrvd when package registry over Nostr on ngit relay?
Its been on my list to look into nostr:nprofile1qqst7a0mzkn59sk24d730je7m708wqedeyjjgjr4kfz5zzku98u4a4cpzemhxue69uhhyetvv9ujuurjd9kkzmpwdejhgqg5waehxw309aex2mrp0yhxgctdw4eju6t0qy2hwumn8ghj7un9d3shjtnwv468xarj9e5k7huxfvf's nostr package management project.
I was reading these docs evening too.
https://github.com/fairpm/fair-protocol/blob/main/docs/start-here.md
To get inspired.