Google and GitHub have been collaborating on a forgery-proof method for signing source code as part of their efforts to secure the software supply chain. Software supply chain security depends on ...