This is a great idea! If the open sources licenses could be changed (if that's even possible!) such that only the original authors or their designees can create these signatures/attestations, then:
... If Google really wanted to ship bash (or whatever) with the certs/attestation, they'd have to cough up enough money to make the developer(s) happy. If they don't Google is out of luck, they cannot sign it themselves. So it becomes a tradeoff of how much money the original developer(s) want vs how valuable it is and/or how much it would cost Google to build their own (and thus be able to sign/attest it) if the original developers got too greedy.
