I think tedunangst is referring to https://man.openbsd.org/signify.1

Even simpler than that, something like bsd ports distfiles checksums, or go.sum, or whatever. If you depend on something, you should know what that something is, and you should have some measure of it in your code/project.

Like a SBOM