I guess I was thinking incentive beyond the legal - like, people often do things because they have desires outside of the legal code. For example - even though

I guess I was thinking incentive beyond the legal - like, people often do things because they have desires outside of the legal code. For example - even though the GPL contains, to the extent legally possible, an "as-is" clause like the MIT liscence, it's extremely common for GPL projects to publish information (ex: hashes, known good package repos, etc) that help people ensure they've gotten the software they expect. Sigstore seems like it's driving towards the same goal.