As I wrote someone earlier...
It would be easier to just sign the git revision hashes at various
intervals.
Such as explicitly including the revision hash that each release is
made from in the release docs itself. And then signing that release.
That way everyone... git repo maintainers, devels, mirrors, users...
can all verify the git repo via that signature. Of course the sig
key material
needs to be handled in a sanitary way, but still, it's the idea that
matters.
And git, not svn, would need to be the canonical repo committers
commit
to, etc.