I believe that FOSS maintainers can gain financial independence and sustain their projects by "selling" supply-chain security assurance to consumers on software contents, packaging, etc.

Disclaimer: I'm building a marketplace that would enable this. Would appreciate feedback/recommendations from my fellow FOSS devs here.