Signing is for the bad days

In this post, Andrew Nesbitt discusses the importance of signing code and artifacts in software development, particularly during times of crisis. He highlights how tools like TUF, in-toto, and Sigstore may seem unnecessary in calm situations but are crucial for security when vulnerabilities or attacks occur. The post emphasizes a proactive approach to security rather than reactive measures.