Verifiability: Version running is built from here

[kaburkett]

This project would greatly benefit from a library that can sign based on a git hash proving the version of the project is matching source control, or something of that nature.

[kaburkett]

Learned about npm packages using SigStore to verify authenticity.

It would be ideal to use something like this: https://www.sigstore.dev/