Since the audits are designed to be used at a per project level and contributed directly into the VCS repo (allowing you to using git signing for example) I don

Since the audits are designed to be used at a per project level and contributed directly into the VCS repo (allowing you to using git signing for example) I don't quite understand what additional off-line cryptographic signatures are required here (considering that Cargo's lockfiles already contain a hash of the crate which would prevent the project from getting an altered version of a crate accidentally and that SHA validation is being considered as part of vet as well https://github.com/mozilla/cargo-vet/issues/116 https://github.com/mozilla/cargo-vet/issues/116).