UMS verifies a package's Ed25519 capsule signature and content digest before you install it. Life is the flagship first entry. Install the PWA, then UMS confirms the installed artifact's digest matches the signed registry — that is self-attestation, not trust in any store or server.
—