In order to be able to sign an application on macOS an organisation needs a DUNS number. At the same time not all open source projects are done by a single lead developer and not all open source projects are registered organisations.
One open source project, that I am helping out, is facing the requirement to have a DUNS number, since the core developer team can vary, so tying signing authority to a single user can be an issue. The open source project is not part of a registered organisation.
Are there any entities that an open source project can register with to be able to sign on their behalf or any other suggested approaches to this issue?
I understand the need to protect users from rogue developers, but at the same time it would be good to find a solution that avoids legitimate open source projects from being penalised.