"In this way, consumers need only trust a small number of secure build platforms rather than the many thousands of developers with upload permissions across various packages."[1]
Bad idea. We should instead have 1000's of people around the world continuously reproducing builds of software, and continuously verifying amongst each other that everyone is building and then using the same peer reviewed version of software.[2] In this way, an attacker is forced to reveal their attack to everyone and can't just compromise the "secure build platforms" and conduct selective attacks.