One of the advantages of open source is that you have the freedom to take the code and fix issues that concern you.
You can Google "open source" for more information - that might be a more productive use of your time than waiting for people who owe you nothing to make changes that you want.
However, it makes very little sense for them to, for example, merge a PR if it uses my public key for verification and not theirs. The problem I'm running into is that I can't just fix the issue without their cooperation.
Regardless, this is all moot because the Composer maintainer is now communicating with me privately to discuss how to fix the problem so it will be solved some day soon.