I mean, it doesn't need to be centralised on a single entity

There was https://tea.xyz/ that does something like this, kind of, to a point, using a blockchain approach to see which packages are used. An extension of the same concept to gits would be interesting?