How about a FLOSS archive that provides peer-reviewed and signed application from a trusted source only?
Automated security updates? A security team that can provide fixes independently from the upstream authors?
...because I just described how Debian worked for the last 20 years.
...because I just described how Debian worked for the last 20 years.