Which implies that you hold a copy of the repository, which is therefore the master copy, as opposed to trusting a third party to do that. No, you do not need

Which implies that you hold a copy of the repository, which is therefore the master copy, as opposed to trusting a third party to do that. No, you do not need to hold a copy of the repository. You only need a known-good hash. Commit signing is a way to vouch that a hash is good. Similarly, when downloading a distribution ISO, you do not have to trust the mirror, you only need someone trusted (e.g. the distribution maintainer) to vouch the correct hash of an ISO. In both cases, you can hash the data that you retrieved and compare to a hash that is known to be good.