Let's say someone hacks a maintainer for the Ubuntu base image. The hacker publishes a new version of the base image with a backdoor.

When the backdoor is detected, you now need a revocation system so the distribution of the malicious image will die. You can theoretically do this on the tracker level, but people may build other trackers that may not propagate the changes.

You still would have a centralized manifest system though, right? It shouldn't hurt Docker much at all to host a few KBs of data describing the hash of each layer, which is still fetched every time, just big downloads are done over torrents.