This is one option that could work. In our organization, I would foresee a problem depending on the engineers to manage their quota on their own without a GUI translating the sha1’s to software package Product/Vendor/Version. I would prefer to depend on the machine than the people. In the MSD dashboard, those values are represented and deleting it from the dashboard also deletes it from the root server. Even management can make sense of the MSD and use it.
It is only the person creating the content that needs access to add/remove things to/from the software repo, not the person deploying the tasks/fixlets.
We require that all BigFix console sessions go through a terminal server with 2 factor authentication. You can make the software repo only available to access from those terminal servers, and only by certain users that you allow to create content using AD security groups, so not all operators would have access.