Code signing and attestation

A flag that names the keyring hands the rulebook to the party being gated

Ed25519 tells you which key signed which bytes. A slice log from the Ranex project shows how a policy path read from the working tree let the gated side pick the rules, and what pinning the trust root to the evaluated commit cost.