One thing that the Go module system solves that seems to be unaddressed in CUE's design based on OCI is the sum database / transparency log. I could add a "Sta

One thing that the Go module system solves that seems to be unaddressed in CUE's design based on OCI is the sum database / transparency log. I could add a "Statement that we might wish to make for a module M" to the "Module contents assurance" section: - The content of module M is the same content that everyone else sees for the same `$path@$version`. Though I guess users can utilize existing solutions like https://github.com/sigstore/cosign https://github.com/sigstore/cosign or rekor (mentioned elsewhere itt).