Namespace is merely a workaround, not a solution. Arbitrary namespace prefix is still open for registration so it can be squatted just like package name. One essential part of the real solution would be sandboxing of build scripts.
Not if it requires dns verification… which would be great.
Domain squatting was a thing long before package name squatting.
yes but its hard to argue that if you've verified that you own say... somecompany.com that you shouldn't have control over the crates.io org for the same name.