I hope that this distro's package management system follows the best practices of The Update Framework[0] or just reimplements a well-engineered existing architecture for distro updates.
Actually the Rust ecosystem is doing some exciting work on supply chain security[1], but it would be good to have something like pacman-bintrans[2] supported from day one of any new distro.