The Linux Foundation's "sigstore" project

I think this is more for clueless projects like yarn that when the repository key expires just make a new one.

No thought about making a keyring package and use it to introduce the new key before the old one expires.

https://github.com/yarnpkg/yarn/issues/7866