Signed and Verifiable Packages

It is absolutely critical that we have clear and verifiable sightlines into the source code supply chains. Software supply chain is one of the most common attack vectors for hackers. Here's a little overview of the topic: https://blog.tidelift.com/the-state-of-package-signing-across-package-managers

ZPM packages should be signed by their authors and ZPM clients should verify these signatures before unpacking the package.