just reading this https://security.googleblog.com/2021/03/introducing-sigstore-easy-code-signing.html