[Moodles]

Honestly (and I hate saying this) but you could stick the hashes in a public blockchain and get clients to verify. But of course this would cost money and any Merkle tree would do, but I can’t believe I just non-ironically suggested a blockchain for something.

[monkeydust]

Ha, I was literally thinking the same thing. This bizarrely might be something suitable for a public blockchain and its not using it.

[Moodles]

Keybase does something similar by sticking the Merkle tree root of hashes of signatures in the bitcoin blockchain: https://book.keybase.io/docs/crypto