While this revision makes progress with the concept of a scoped package identifier, I'm concerned that it does not go far enough in the area of package id lookup. In particular, and perhaps unintentionally, it seems to perpetuate a large anti-competitive bias in favor of GitHub, (which happens to be the employer of all three proposal authors).
Let's start by stipulating that GitHub is home to the large majority of open source projects available in the swift ecosystem. A large percentage of projects are-already and will-be hosted there.
According to my understanding of this revision, a user may configure, either globally or per-project, a list of registries in which to resolve package-ids, falling back to a default. Mappings from "scope" to registry outside of that default must be explicit. Given that so many projects live at GitHub, it will be natural to configure GitHub as the default registry.
So my concern is this: that the design presented in this revision perpetuates a bias toward GitHub. It will be the de-facto default registry because a high percentage of packages used by any particular user or project will likely be hosted at GitHub. To specify any non-github packages will require additional configuration, which will be tedious, and likely per-target-package; this biases choice of hosting toward GitHub, and against any existing or future alternatives.