> I think the main thing missing for me is built-in 
  > vendoring, to not be dependent on a third party 
  > (crates.io).

You can use git dependencies if you'd prefer, which can go to whatever domain you'd like.

(Also, you only need to hit crates.io to fetch the packages you don't have, after that initial download, it shouldn't need to touch the network again until you've modified your dependencies.)