@rugk I couldn't immediately tell, but is sigstore (sigstore.dev/) a part of that approach, or is it a different project doing something similar (but only a part of the what'd be required)?