Release attestations
One file per release: <release>.intoto.jsonl, a DSSE envelope over the in-toto Statement v1 (SLSA Provenance v1) that names every artifact of the release by its sha256, signed with the release key in ../slsa/. How it is made and how to verify it: docs/SLSA.md.