The release archive carries a Sigstore attestation bound to the GitHub workflow run that built it. There is no key to import.
gh attestation verify \
crimp-v0.1.0.tar.gz \
--repo thearchitect0x-glitch/crimp
To check the archive is byte-for-byte what was published:
sha256sum -c crimp-v0.1.0.tar.gz.sha256
DigestSource unavailable · not yet pulled by this build · see the release assets