Pypi could do this. Or, they could require that someone demonstrate proof of ownership for a namespace by signing it with a certificate tied to the domain name (so you couldn't claim the com.bigco namespace without having the certs, which you can't get without owning that domain). There could even be signature requirements/proof for each package and/or version uploaded.
Depending on how something like this is implemented, maybe com.github could set it up to pull straight from the project repo.
Just because there's ways it could go poorly, doesn't mean it will go poorly.
