Review?

> Some kind of way of reliably checking the author of a change

What would be the point of that? As we saw with xz it isn't the author (or any aspect of their identity) that matters, its the code that matters. The many many times devs got hacked and their credentials were used to push malware. Or they sold their maintainership of their program (possibly including credentials), and spyware got added. Or that time an upstream released with a backdoor that would only activate on a particular Debian person's machine.

> via proper code signing and on-boarding of developers

Distros like Debian have both of those, but they don't have enough code review that they would always block any of the above.