Your best bet is #1 along with clear Terms of Service. #2 is not happening. The value of Gumroad is not in the software (you clearly can build it yourself for the most part). The value is in the ecosystem and the tools/resources they have to validate uploads (most likely manual but they can afford to do that).