IPFS has a mechanism called IPNS where any /ipns/author-hash can resolve to /ipfs/hash and the ipns record is signed and can only be provided by that signer/author.

But this is just another way of authenticating the "author". You can also use dns (if you can trust it), or you can use signed content, or you can get the ipfs hash through a channel you trust.

The main idea though, is that IPFS content is authenticated by default because it is referenced by its own hash. The problem on obtaining a hash you can trust is just a layer above and solvable in multiple ways, as needed.