How to Verify a Download: SHA-256, GPG and Sigstore

A matching SHA-256 checksum proves one thing: the file you have is the file the checksum describes. It does not prove the file is safe, or that it came from the project you think it did. If an attacke