I'm not sure that really gives you the guarantees you think it does, though.

For example, I could push some malicious code, tag it, wait for Packagist to finish pulling it to publish a package, and then amend history to remove the malicious code, rewrite the git-tag, and force-push both to the git server.

This scheme makes it hard/impossible to push mismatching code by accident, but doesn't do much to stop a malicious actor.