Sigstore / cosign
An open source ecosystem (Linux Foundation/OpenSSF) for signing and verifying software artifacts — container images, binaries, packages. cosign is the tool; the breakthrough is "keyless signing": you sign with your identity (OIDC) instead of managing long-lived private keys.
Problem: code signing is old but a hassle — creating, protecting, and rotating private signing keys is so fiddly that most skipped it. Sigstore's breakthrough: keyless signing — you authenticate with an existing OIDC account (GitHub, Google), get a short-lived one-time certificate from Sigstore's CA (Fulcio), sign, and everything is logged in a public, immutable transparency log (Rekor). No private key to leak or manage. Verification checks the signature against the transparency log. Use case: sign container images in CI so consumers can verify they come from the right source and haven't been tampered with (admission controllers in Kubernetes can require signed images). It's the practical tool that makes SLSA provenance and a signed delivery chain feasible. A cornerstone of the modern supply-chain security movement. Related to SLSA and SBOM.