There is an adjacent initiative just about this that you might find useful and addresses many of the same things https://www.sigstore.dev/

because they’re (mostly? all?) centralized?