I think a person working with Zig that doesn’t know all the major packages, the major authors, the community forums, etc., cannot easily answer “how do I do X” and “where can I find the most recognized package for Y”. I know because I’m that person. Decentralized systems don’t solve it either. So we end up Googling and checking package indexes.
The onus in such centralized system falls to the same people as decentralized - the community. We should build something that makes it easy for good players to act on that responsibility instead of seeing bad actors abuse it. That was my intention and hope.
This was just posted today: An open-source package registry where you can browse, search and actually discover Zig libraries and applications, which tells me the need is real. It’s the third or fourth of such an implementation, still having the same drawbacks that I’m trying to resolve with my proposal.
Decentralized solutions require greater engineering effort, create a higher bar for users (which means they circumvent them), and still don’t solve some of the key issues of trust and discoverability.
I was hoping this brainstorming would receive more interest, but that hasn’t happened. So maybe this isn’t what the Zig world needs. I think I’m just gonna let go of this idea. Not every idea is a winner. 
I learned a lot by writing the code for it, so there’s always a silver lining.
I just want to say I greatly appreciate the feedback everyone (and especially you) provided here and the willingness to engage in it at depth. Thank you.