The Linux Foundation's "sigstore" project

You seem very confused. I have zero association whatsoever with Linux Foundation nor do I work for any organization associated with it. I do have some experience getting free software licensing issued resolved as a volunteer distro package maintainer and developer for several years and that's the perspective I am sharing here. The enforcement of licensing requirements if the authors of the library care enough to do it has to initiated by them. I don't see any evidence at all for that. That's my point.