package.el with Melpa has been my go-to for years, and I didn't much care when they expelled all EmacsWiki packages from Melpa for security reasons. That did leave all of Drew Adams' work inaccessible to me, though. After trying Quelpa and running into bugs relating to errors during temporary tarball generation, I decided that straight.el might be worth considering. It is very opinionated, in that it encourages you to abandon package.el entirely, which I haven't tried yet, but I have been able to pull in the Emacsmirror package for bookmark+ successfully. I'm also somewhat interested in the idea of going back to git repositories for tracking emacs packages. It's the approach I used before package.el came around, and it makes it easy to run your own infrastructure for your own packages. I recently rewrote my Emacs config in a more modular format, and it wouldn't be hard for me to host that repository myself and simply pull it in as an Emacs package like any other. This approach also had the side benefit that in doesn't rely on a single server (Melpa) for all packages.

raxod502/straight.el: Next-generation, purely functional package manager for the Emacs hacker