Maybe after signing it (but before releasing it), the CI/CD should upload the signed hash to an independent third-party publicly-accessible append-only log (lik

Maybe after signing it (but before releasing it), the CI/CD should upload the signed hash to an independent third-party publicly-accessible append-only log (like Certificate Transparency). Assuming the binary is reproducibly buildable, different internal teams can try rebuilding the source and checking that the signature matches what's in the public log, and that each entry in the log has a corresponding commit in the source repo.