Like you mentioned, you could use a Message Authentication Code along with Public/Private key cryptography. This is pretty much how message authentication works (proving a message actually came from who the sender claims they are without being modified), and can be used in your case to verify the file hasn't been changed after being decrypted. For example:
Bob has already gotten Alice's private key and verified it belongs to her
- Alice takes her file and hashes it.
- Alice takes that hash and encrypts it with her private key. This means that the only way to decrypt the hash is with the opposite key, her public key. Since Bob knows her public key, he can decrypt it.
- Alice encrypts her file and the ecnrypted hash with a symmetric cipher (ie. AES), in which Bob knows the password to.
- Bob decrypts the file and hash. Let's say he modified it even though Alice told him not to.
- Now, Charlie wants a copy of the file. Bob is willing to give him a copy. Bob gives him the file along with the hash.
- Charlie wants to make sure that Bob didn't change the file, so he goes and hashes it. Bob also has Alice's public key, so he uses that to decrypt the hash from Alice that Bob included with the file. He then compares them and sees they don't match. This means the file was modified on its way from Alice to Charlie Since Charlie wants to stay safe, he doesn't use that file because he knows it was modified.
This is the basis of Message Signing. It ensures nobody has changed the file in transit. As long as you know the sender's public key, then this system should be foolproof in guaranteeing that nobody changed the file, essentially making it 'read-only'.