Sounds like Microsoft… you get Microsoft npm releases signed if you use Microsoft GitHub Actions. Deployed to Microsoft Azure, built with Microsoft GitHub Codespaces enhanced with Microsoft GitHub Copilot, all from your Microsoft Windows machine.

Folks shouldn’t be forced to use proprietary software from US-based, publicly-traded megacorporotations just to build & sign their libre software.