There is an adjacent initiative just about this that you might find useful and addresses many of the same things https://www.sigstore.dev/