I would say that in general I think that the proposal by Robert seems too complex. I'm also thinking that Dub has a too strong connection to repositories. The way Orbit works is that only depends on a Zip file containing all files needed to build the package and a file with meta info. There's no restriction of a 1-to-1 mapping of package and repository. There can be multiple packages from a single repository and there can be a single package from multiple repositories. Orbit doesn't care where the files come from, just that only necessary files are present.

That connection basically exists only in the registry implementation.
Dub just downloads a zip file from there with the contents of the
package. From where that file comes is, as far as Dub is concerned,
completely irrelevant. So uploading of custom zip packages would be an
option, or adding support for (public) sub-packages in a repository one
way or another.

Also, a valid registry can just be a public folder of files (one index
file with a list of all packages and a JSON description + a zip file per
package and per version).