Why not just have the trusted vendor expose an api for all the info? An append only linked list is ludicrously expensive solution to this problem. To a person with a hammer, everything is a nail.

Also, the problem itself is very convoluted and likely doesn't exist in the real world. You trust the vendors enough to let them do the data entry but distrust them thinking that they will manipulate the entered data somehow? It's a very strange situation