Post #1834536

@tmr232 @sethmlarson Tooling obviously makes it way more useful. But for a PR review there's 2 things. One is if you know a project uses trusted publishing then their should be attestation data. Two, if the attestation data suddenly disappears or changes in an odd way, be wary and check if the project changed something intentionally.