> Then it doesn't matter if the domain expires and someone re-registers it, since they don't have the developer's private keys. A principal reason to use sigs

> Then it doesn't matter if the domain expires and someone re-registers it, since they don't have the developer's private keys. A principal reason to use sigstore is to get out of the business of handling private keys entirely. It turns a key management problem into an identity problem, the latter being much easier to solve at scale.