Many of those things are solved by outsourcing it to a distro. Sure it's not perfect but having a maintainer layer between the developers and the users has proven much safer than blindly trusting the developers like npm. It also scales much better than doing it yourself.

Many have been focusing on reproducible builds lately too, so you can verify that a binary is from a particular version of the source code.