Doesn't IPFS solve some of the authenticity issues at least. Not very familiar with it but (from my shallow understanding) if the signatures matches some published version it is guaranteed to be the same file.

[1] https://ipfs.io