This is a solved problem, just look at how EFF's certbot works. You cannot just claim that you are porn.com unless you put a payload there that matches what the bot expects.
replyAnd force everyone who wants to publish an extension to buy and manage a domain name? What if it expires? You're just replacing one set of problems with another.
replyYou could make it a requirement only for people who want to attribute “made by”. If you publish a no name extension, you could skip it.
reply> Code signing, yes, but not for organization verification
replyThey don’t do organization verification, but they do verify where code comes from. You may be sure that packages are built by alpine, which made sure that the dist files comes from the sources that the maintainers added, and the latter ensure that the sources are correct. In truth, it’s a very small circle of trust.
[flagged]
reply