> if subsequent publications came from the same entity The way you do that is by having signed packages. Gov IDs don't help with that, unless the registry veri

> if subsequent publications came from the same entity The way you do that is by having signed packages. Gov IDs don't help with that, unless the registry verified the ID every time you published an update, which is impractical (unless you have a smart ID card, but most governments don't issue those).