I think you have the right idea
We'd have to deal a bit with key management, but companies like Red Hat seem to have that licked. (Downloads through up2date are all signed and Red Hat's key is automatically installed at setup time.)
Tom Sinclair
"This is a lovely party," said the Bursar to a chair, "I wish I was here."
-- The Bursar is a man under a *lot* of stress
(Terry Pratchett, Lords and Ladies)