Secure the package supply chain

ZPM, like package managers across the board, need to encourage best practices for securing the software supply chain. The https://in-toto.io/ project creates a framework for part of the puzzle and is a CNCF project, so it's standards-based. Would you consider investigating it to see if we can integrate it with ZPM?