Fundamentally, the fix isn't technical; it's social / structural.

Companies either hold themselves accountable for signing off on the dependencies they use, hold the repos accountable for signing off the dependencies, or keep doing what we've been doing.

The third option is amortized cheapest.