I’ve been saying that for a while. FOSS maintainers can gain financial independence and sustain their projects by "selling" supply-chain security assurance to consumers on software contents, packaging, etc.

Disclaimer: I'm building a marketplace that would enable this.