> But how would distro sign modules that are built externally? > It should be the pretty same situation.
I would start with the "would" and lawyers and liability and then stop worrying about the how. Absent someone actually intending to do it and saying so.