Instead of downloading Bitmonero updates from centralized sources such as GitHub or Getmonero would it be possible to distribute updates by using the existing Monero P2P network of full nodes?
If this is technically possible, is there also a way the mining network could also verify the authenticity of the download?
It would be technically possible. However, several considerations apply:
how do you trust what you receive is really a bona fide update ? You trust the blockchain because it's got PoW with high enough difficulty, but transactions are arbitrary. There is no mechanism to authentify the origin of something on the Monero P2P network.
you don't want to put this on the blockchain. Monero is supposed to fork every six months. This would mean a number of multi megabytes blobs on the chain. At last one for Windows, which is (according to https://getmonero.org/downloads/) 48.6 MB for Win64. If you intended this to be the main update mechanism, you'd want all major platforms to have ready made binaries. Win32, Win64, Linux, Mac, and a source fallback (how this'd work is left as an exercise for the reader). So maybe 400 MB a year. It'd be a noticeable bump on the blockchain, and I've not even counted the ARM versions, etc.
if it's not on the blockchain, but just offered as a download via the Monero P2P network, then a node has a choice: either download all the updates, or download just the one for that node's architecture, thereby giving away some identifying information.
Last in this list, you would want to ensure the update really comes from someone trusted. In this case, a member of the core team (I'll ignore all problems related to changes in trust over time here). You'll want a signature with something like GPG, so you can ensure the update was signed with a key that you trust. When you do this, you could have downloaded the update from anywhere. Verifying it means you could downloaded it from nsa.gov or scammers-r-us.com, and be as safe as it you had got it directly from getmonero.org.
All that said, the advantage of having an update available via the P2P network is that, assuming Kovri, you can download the update transparently, and without letting your snooping ISP (because, let's face it, all of them are creepy peeping toms) know you are downloading a Monero update. You'd want to use a temporary one shot Kovri identity for the download though, to protect your OS configuration (I'm not sure how much fingerprinting is possible via I2P).
would it be possible to distribute updates by using the existing Monero P2P network of full nodes?
Yes, it is possible. It would require some sort of built-in torrent-like code.
If this is technically possible, is there also a way the mining network could also verify the authenticity of the download?
Yes, the hash of the file could be stored in a block somehow.
Yes. In theory, binary data of the file could be encoded in one or multiple transactions, and stored in TXextra. If the community trusted the owner of the wallet creating those transactions, then it could be a way to do what you described.
However, I don't see any benefit in doing so, as it only adds redundancy and no additional security compared to signing binaries with PGP, for example.
