Hacker News Reader

agree, sigstore is an awesome project when you delve into the architecture. transparency logs and ephemeral key signing!

You'll probably enjoy how it is being used to secure the Arch Linux package ecosystem then: