sigstore

'Keyless' means no long-lived key, not no keys. The follow-up that separates candidates: what does your verification policy actually check?

A model is a directory, not a file. Sign the whole thing, tie the signature to the pipeline that produced it, and refuse to load anything that does not match.

Signed software outlives the certificate that signed it. The scored answer explains how a timestamp proves the signature was made while the certificate was valid, and how revocation dates interact with it.

A release is only as trustworthy as the weakest step a customer cannot check. The scored answer chains source, build, artefact and publication into evidence a consumer verifies automatically.