Seems to me stronger user accounts could be bolted onto an existing DVCS quite easily. The hard part would be working out the PKI, but adding digital signatures to commit objects would be easy.

PKI probably would need to be pluggable to meet the variety of project needs out there. I'd imagine enterprise projects would use a corporate CA, some small startups or open source might be comfortable with a quick-start "ring-of-trust" distributed scheme, etc. Github and other hosting providers could offer CA services. Interesting way to prove code ownership in any case.