Don’t think within a package manager is the right place. Fundamentally there needs to be an onion layer around the entire activity (ie. a virtual machine, qubeos, oci/container, gitpod, github codespaces, namespace jail).
Example of tasty file that a package manager should never be able to read: /Users/mxey/.ssh/ssh_rsa or /Users/mxey/.netrc
Example of tasty file that a package manager should never be able to read: /Users/mxey/.ssh/ssh_rsa or /Users/mxey/.netrc