Artifact Signing & Provenance

Sign every shipped artifact and publish its bill of materials so customers can verify what they received.