If I didn't hate GitLab's gitlab-org/gitlab issue tracker so much I'd go look to see if them offering OpenVSX registry was on the roadmap, because then an organization could mirror the .vsix into their GitLab instance and not suffer outages (in addition to the supply chain safety aspects)

Also, I wonder how hard it would be to teach VSCodium/Theia to pull extensions from OCI because it seems to work great as a distribution mechanism for Homebrew and allows shipping a .vsix from your own GitHub/GitLab account, since both of those offer no-cost OCI image registries scoped to the project