Sigstore: Secure and Scalable Infrastructure for Signing and Verifying Software

Sigstore is an open-source project that aims to make software signing easy and readily available for people to use. It integrates with existing key management solutions and introduces the concept of keyless signing, focusing on identities rather than individual keys. Sigstore is widely supported in open-source software but not widely used. It offers improvements in key management, compromise detection, revocation, and identity verification. Many organizations, including Kubernetes, npm, and CPython, are already using Sigstore.