The thing I don't get, is, I'm using Git repos as source for my packages for years now, why can't everyone do this?
Or you can tie it to Github and then download a release from their CDN.
Example:
"dependencies": { "myprivatemodule": "git+ssh://git@github.com:user/project.git#commit-hash" }
A package manager where every release has to be reviewed, tested and approved before they become generally available would be a pretty interesting case, I know bigger companies who are reluctant to upgrade because of known bugs in the past would be willing to pay for something like that.