How about several build servers, and a system for comparing builds -- giving an error if one (or more) of the builds differ?
You'd still have to run that same algorithm against all distribution mirrors, and even then, you'd have to find a way for any suspect distribution site not to be able to detect who's downloading (giving a potential reviewer a "good" build, while giving everyone else a false one).
Come to think of it, this might be a good case for distribution over bittorrent?
