Itch just has to require one payment on the itch account, that way someone signs a virus they have an address to give the authorities and it becomes the card/banks problem.
Thinking about this more, itch should absolutely make a verified badge for all accounts that made a purchase with a card in their proper name. That way you can trust the download!!!
I'm proposing it... it's a no brainer!!!