Thanks for the cosign mention! Maintainer here. The link is github.com/sigstore/cosign for anyone reading along!