Like gpg the payload and make sure npm has a public key.