Maybe with a chain like with SSL certificates & authorities? Or maybe there could be a reference database with all the versions signed by a given authority so that you could verify it's an approved version? Why not go even further and show the same kind of alerts / block content if the source / signature can't be trusted?