Maybe go Tanner's way and just use a private repository? Marmistrz would definitely host it, maybe CSSU repo too? Not sure how transparent it would be, but including compilable source would definitely help in that matter (don't trust .deb, compile it yourself).