Haven’t heard of sigstore before. Need to keep this list around for next time I see someone recommending PGP