Presumably the registry could also have some mechanism of identifying those making the reports (maybe limited to insurance companies), and not just accept rando

Presumably the registry could also have some mechanism of identifying those making the reports (maybe limited to insurance companies), and not just accept random reports of ransom payments. That makes it less ideal, sure, but it could help prevent the scenario you posed.