we are actually talking about this right now. I talked to some folks at the OSS summit a couple weeks back about SBOMs and am noodling on whether we can use standard tooling to provide even stronger forms of module signing.