My understanding is that the integrity of the contents is assured due to the identifier being a hash of the content. From there I don't think it's really needed for a whole protocol to verify the author. Couldn't something as simple as a gpg signature be sufficient? If they signed the hash and gave it to you then it would be good