I don't think you can underestimate how important immutability and trustlessness are in cases like these. Don't get me wrong, your setup would be an improvement

I don't think you can underestimate how important immutability and trustlessness are in cases like these. Don't get me wrong, your setup would be an improvement over many manually curated processes (and in my own business, I use ledger-cli.org with the files under version control), but the lack of the two aforementioned attributes makes it a technological change that doesn't change the underlying politics. In the end, you're just moving the third party elsewhere, and you'd still need staff to verify that people are committing their finances regularly and aren't trying to sneak in retroactive changes in large commits. If someone ever decides to try to get away with rewriting their git history and arguing that the SEC accepted an erroneous pull request that contains the wrong history, that would need to be audited/litigated out to resolve whose tree was correct (just because the SEC owns the master repo doesn't necessarily mean that their custodians of it haven't rewritten history themselves). Also, the fact that the "authority" repo is centralized means you may have issues if for some reason it's inaccessible (these issues arise in reality when GitHub goes down).