yep, you got it.

And further to this, anyone could stand up their own sigstore service. In fact we expect some of the bigger oss projects to do just that.