Signature hashs of the files, (possibly/probably) with those signature hashs being further signed/verfied with the user's key, to establish trust. With further chains of trust through key signing, if needed.