Vetting the cargo

I find it a bit distressing that no cryptography is used to sign the audits.toml file.

GPG has a serious usability problem, but that doesn't mean an unsigned audit is fine.

Pushing it further, if we want to protect the supply chain, shouldn't the audit also record some sort of sha###sum of the crate to avoid having that file poisoned by a bad guy with filesystem access and republished under the same name?

If I can't prove "Alice TheAuditor" actually audited exactly this specific item, I'm not sure what this gains...