GitHub Artifact Attestations sign and verify software artifacts
Briefly