I tested out an experimental packaging of Cosign (Sigstore) for Debian thanks to Simon Josefsson. Adoption of Sigstore by Linux distros is an exciting sign, there will be an abundance of Sigstore attestations in the near-future thanks to PEP 740 for PyPI.