We can use cryptography instead of 3rd parties to solve most of the trust problem. The companies publish encrypted documentation of a vulnerability so that when they claim a researcher has found something already known, they share the key to prove they already know it. A 3rd party might be useful in a complaint process where the researcher claims the two vulnerabilities are not the same. Given that is hopefully now a minority case, the researcher can resort to the court of public opinion.

It doesn't need to be a block-chain but I guess it would help create a tamper proof time ordered record.