PGP vs sigstore: the match at Maven Central by Hervé Boutemy