Does something prevent distributing the patches?

Then you also trust them, else the could be the one who leaked the compromised patchset.

Also even if you trust them you could make it hard to verify the validness of the leaked patch set, *if* they would release a code with a signature (I still doubt they would do that, this is merely a thought experiment). Comparing semantics is not always trivial, especially if you have thousands of thousands diffs on kernel code. Even if you are experienced kernel hacker you will still need quite some time if you really want to ensure nothing slips.

I never ever would apply a leaked security patch set to anything worth a dime for me.

If you have a trusted contact with a subscription the easiest way would be to just use their copy and stay silent.