> a trusted party reviewing code & posting content integrity hashes

That sounds like some combination of Crev[0], Sigstore[1], and Trillian[2].

[0] https://github.com/crev-dev/cargo-crev/blob/master/cargo-cre...

[1] https://docs.sigstore.dev/

[2] https://transparency.dev/