You could possibly use ZFS with sha256 checksums for that purpose? You would have to somehow sign the merkle root each time you write it, not sure how easy that would be. Perhaps write it to another partition and hope it's atomic enough? Or ZFS encryption would probably do it already if you don't need the system in cleartext.

https://blogs.oracle.com/bonwick/zfs-end-to-end-data-integri...