Later-tier scaffold for skill package signature verification.
Scope: Design placeholder only. Does not sign packages or manage private keys.
Planned Workflow
- Load packaged skill ZIP output from the repo packaging dry-run.
- Verify signature manifest against maintainer trust store (TBD).
- Report pass/fail without mutating installed harness skills.
Validation Contract
uv run python skills/skill-signing-verifier/scripts/check.py
Critical Rules
- Never commit or print private signing keys.
- Route live signing to maintainer-controlled release tooling when implemented.
- Pair with security-scanner for executable-surface review until signing ships.