Is there any apt repo software that permits multiple parties to upload to a repo but also enforces that people can't upload new versions of other people's packages?
As it happens, Debian itself kinda does this (Debian "maintainers" can only upload to specific package names), but I don't think anyone else runs that software. The usual third-party repo tools like reprepro and aptly don't support it, as far as I know. And sites like Launchpad or OBS just set up a separate apt repo per account (or even multiple apt repos per account), because doing that is very easy.
In other words - yes, the trust model you propose is coherent, but I don't think anyone actually does that, because there's a more straightforward option already.
As it happens, Debian itself kinda does this (Debian "maintainers" can only upload to specific package names), but I don't think anyone else runs that software. The usual third-party repo tools like reprepro and aptly don't support it, as far as I know. And sites like Launchpad or OBS just set up a separate apt repo per account (or even multiple apt repos per account), because doing that is very easy.
In other words - yes, the trust model you propose is coherent, but I don't think anyone actually does that, because there's a more straightforward option already.