I think Guix has the potential to do that. At least the hash for the reproducible build is part of the package definition.

So it seems like one should be able to just have that hash, and then rely on the backend to just go fetch a blob that has that hash from a list of possible sources (centralized repo, bittorrent tracker, IPFS, etc.)