Highly experimental tool to infer trust to a git commit through pypi sigstore attestations - View it on GitHub