The package hosting protocol is relatively trivial. I believe a couple of alternative implementations have been written, but I'm not sure they're maintained because there's no point. Anyone can publish to the Snap Store. Because snaps are sandboxed at the client end, there's no gate except automated checks.