I mean, there’s a million facets to this and I’m sure you looked but if you want local binaries to be secure, use nix and lock it down to that?

The hash thing sounds cool but I can’t imagine that working under any other circumstance than nix anyway since dynamic linking will always be an issue.