Investigate npm package signing using sigstore

[jevonearth]

Users of Taquito would like assurance that Taquito packages are secure and untampered via software supply chain attacks

Describe the solution you'd like

Investigate the use of sigstore.dev

Particularly; https://github.com/sigstore/sigstore-js

[hu3man]

Is this for Taqueria or Taquito @jev?