Matthew Garrett

The distributions can review the hypervisor code (then sign it as a symbol of trust) and the kernel can then verify its integrity at runtime (just like the firmware verifies the bootloader's integrity, and the bootloader the kernel's). The hypervisor can then emulate secure boot for the virtual machines and continue the chain. Note that you're already half-way there with KVM, since most of its code runs in the kernel itself.

Other hypervisors wouldn't be any different from any other package offered by the distribution, at least if the maintainers provide security support for all of them (as is the case for most serious distros). It would be pointless to sign and verify every binary, library and script on the system if the code isn't trusted.

Mature infrastructure for integrity checking already exists: most IDS do file change tracking (they would need to be explicitely supported by the kernel though), but see the Linux Integrity Subsystem (in the form of the Integrity Measurement Architecture and the Extended Verification Module).