> Multiple users accounts with all user data completely sandboxed and restricted to each user.

User data and user programs. Clean installation kind of user programs.

> Verified checksums on a blockchain are only useful if they are verified by some provider who associates a blockchain ID with a real-world identity.

Nix associates a unique id to each program version or package or config file. The verification happens on the Nix package manager.

The user uploads his exact config of OS somewhere, in his own home server, at a goverment server, at AWS, on a blockchain, somewhere. A blockchain seems like the best solution to me.