Correct me if I'm wrong, but the package managers of all popular Linux distros (except for Arch Linux, who are moving to bring it in soon) have had code signing for years now. It's not decentralised however the package management system isn't either.