The issues described in this article sound like exactly what the Uptane[0] project was designed to address, which is also open source.

[0] https://uptane.github.io/