Answering your direct question:
You should read the pages on Secure Apt Ubuntu, and a slightly more thorough page on Secure Apt Debian.
The summary is that packages are signed using gpg (aka "gnupg") which is a distributed web-of-trust style public key infrastructure - this should make you happy. In the PGP / GPG world, people sign each other's keys to form a "web of trust". By default on a new Debian system, there's one trusted key in your apt
keyring belonging to
Debian Archive Automatic Signing Key <ftpmaster@debian.org>
so anybody they trust, you automatically trust. If you add a 3rd party repository / PPA to apt, part of that process is adding their signing key to apt
's list of trusted keys.
If you want to know more about how packages are vetted, and how signers are added to the trusted list, I'm sure you can find out more by digging into the Ubuntu and Debian communities.
Answering the broader question:
Is it really true that a central authority is less trustworthy than a distributed system? I don't think it is.
Whatever you may think about Apple or Microsoft's requirement to bend to law enforcement, one thing you can be sure of is that they hire good security teams, and that the server holding the signing key is very well secured against hackers - probably with hundreds of thousands of dollars of security equipment and firewalls. Can the same be said of every gpg user who has signing power on the ubuntu repositories? I don't even know how I would go about auditing that ... and that's the point because a web is only as strong is its weakest link.
So yes, Apple or Microsoft may be forced to sign something on behalf of the government (which Apple is spending a lot of money fighting in court, by the way), but distributed systems are WAAYY easier to hack into and steal a key simply because individuals can not spend as much money on security as large companies can. So what's the lesser of two evils: a large security-conscious company under American law, or a collection of individuals who are easily hacked?