Release attestations
Two files per release, each a DSSE envelope over an in-toto Statement v1 (SLSA Provenance v1), signed with the release key in ../slsa/: <release>.intoto.jsonl (dwarves' statement over the crates it packed) and <release>-media.intoto.jsonl (cargo xtask release-attest: every medium, each app archive and every product binary by sha256). How it is made and how to verify it: docs/v2/07-build-thing.md.