It kind of does - you can use IMA to enforce signature validation, even including an x509 chain. But it using extended attributes for this results in a bunch of

It kind of does - you can use IMA to enforce signature validation, even including an x509 chain. But it using extended attributes for this results in a bunch of difficulties, and there's no good distro support for it at present.