[Ayesh]

Composer/packagist has done many things right: namespaced packages, and downloads straight from VCS to name a few.

I wouldn't consider the Github personal token to be an issue either. It's a one-time setup per device, and my server (which only pulls code) never needed one, because it uses the lock files to download the exact commit/tag, and this significantly reduces the number of API calls made.