GNOME proposes Toolpak: signed disk images for the tools that can't run confined
A GNOME OS developer's proposal for the gap between Flatpak and the tools that refuse to be sandboxed: developer utilities shipped as signed, verity-checked disk images, mounted in a namespace and prepended to your PATH. It is a funded prototype, not a product.