Just throwing these files around without accountability is dangerous as it leaves open the potential of everyone being too cheap or lazy to do their own verification

I think perhaps the threat model here is overblown. Releasing them with simple CS hashes is fine, IMO.