This question is important: what are the alternatives to npm? Surely someone has something out there with code signing and single-use package names for node/JS?