The trouble with firmware

It seems plausible to create a git that does not store certain blobs that it claims to have. What seems more difficult is to have a git which would alter the trees so that the offending filename is not listed. How would you do that and still be able to verify the integrity of the tree against the SHA1?

I think the filename in the tree is even a bigger concern than the blob references.