This is great will it also verify the commits of they are signed?
This way zapstore signed the release event, later devs can proof they own the GitHub repo and then take over and sign the packages for that app.