HMAC are symmetric signatures, which means that anyone who can check the signature can also poison the cache (so pushing only from the CI are reading/checking o

HMAC are symmetric signatures, which means that anyone who can check the signature can also poison the cache (so pushing only from the CI are reading/checking on the dev machines would not be possible)