> but a GitHub URL is not a secure package identifier, it was never designed this way, and it's an unfortunate hack that it's become a defacto standard.

Thank you. GitHub shouldn't be the only line of defense between a malicious coder and your software.