You could possibly use ZFS with sha256 checksums for that purpose? You would have to somehow sign the merkle root each time you write it, not sure how easy that would be. Perhaps write it to another partition and hope it's atomic enough? Or ZFS encryption would probably do it already if you don't need the system in cleartext.
The tricky part with modifications is described in the article: You would have to have the signing key available on the system which usually means it could be extracted from that system and then looses all protections.
You then have write amplification from the merkle tree. Ignoring performance, something like this should be possible though. For atomicity, there’s going to be some clever journaling based solution.
https://blogs.oracle.com/bonwick/zfs-end-to-end-data-integri...