Easy fix: freeze their developer signing accounts like they did with VeraCrypt and WireGuard, demand that they remove spyware to regain access to sign their future updates.