Your comments

Hi, I'm coming back after a while away from XDM :P

IMO, PHP may be a good choice for some reasons :
- easiest and cheapest to host online
- can evolve in order to run python script server side to do stuff
- web developpers that don't want to do python can participate to XDM. (it should be interesting to know if there is some guys in this case)
- there is more PHP dev than Python dev on github.

I know you prefere python, I prefere python too, but I'm not against PHP and I think it's the better solution for the current size of the project.
You have already a lot of things to do on XDM/XEM, I don't think it's a good idea to give you a task as this one. I think you should find a PHP guy, that dream to participate on XDM, ready to handle this task.
I think the best way is a marketplace (like playstore, chrome store, etc..) where developpers can add theirs plugins (and a verification can be done on each plugin, checking it isn't a trojan - verifications can be done by moderators - ).
I think it's the best way  for a far future, when XDM will be use by a lot of people.

I don't link the meta.json method, it's not very easy to the developper to follow all his plugins versions on the .py and on the meta.json, and it isn't very easy to the user to search all repositories and put them on XDM.

I think it's possible to permits to the developper to share an update in a store.
On the user side, it will be great to give to the user :
- graphical store with icon of each plugins.
- changelog of each versions (allow you to know why you are updating a plugin)
- a short description of the plugin
- some screenshot

On the developper side, it will be great to give to the dev :
- graphical form where he can follow his plugins (download count, comments, rating ...)
- simply add an update filling a changelog form (and changing images and text if he needs to). Then the store handles the rest (versioning...)
-  complete form with all informations (images and texts) when adding a plugin.

Imho, a more structured method to get plugins reassure users. (he can follows comments and rating of plugins, and maybe trust in the "trojan test" if it exists).

It's my opinion, i know it isn't the easiest way but I prefere a good way instead of a easy one.