Comment by candiddevmike

That's happening already: https://www.sigstore.dev/

Anyone who talks about supply chain and doesn't mention/integrate with sigstore hasn't done their homework, IMO.