The Linux Foundation's "sigstore" project

Not even that, the sigstore-with-oauth sketched in the article will not tell you whether you should trust code that their DB says was signed by lwn@example.com . So you will still need to maintain some sort of trust DB in addition to this sigstore to answer that question.