Hi, I'm trying to get dependency verification going

<verification-metadata ...>
   <configuration>
        <trusted-keys>
            <trusted-key id="0E225917414670F4442C250DFD533C07C264648F">
                <trusting group="androidx.activity"/>
                ....
            </trusted-key>
        </trusted-keys>

    <components>
        <component group="androidx.activity" name="activity" version="1.0.0"> <-------------------------
         <artifact name="activity-1.0.0.aar">
            <sha256 value="d1bc9842455c2e534415d88c44df4d52413b478db9093a1ba36324f705f44c3d" origin="Generated by Gradle" reason="Artifact is not signed"/>
         </artifact>
        </component>
        <component group="androidx.activity" name="activity" version="1.13.0"> <---------------------------
         <artifact name="activity-1.13.0.aar">
            <sha256 value="bd4f19a5f00effed0eecad0a310b1f2169b9fc66236a3ba743a222eb77747ee1" origin="Generated by Gradle"/>
         </artifact>
        </component>
    </components>

</verification-metadata>

I run

./gradlew --write-verification-metadata pgp,sha256 --export-keys build

and that's what I get. I was under impression that signatures, i.e. the trusted-keys trump checksums (components), so if

androidx.activity

is already "covered" by that trusted key why is it under components again? 1) I get the first one (1.0.0) since its old and probably they didnt have signing setup yet 2) but I dont get the 1.13.0, since that is latest and also it doesnt say

reason