The install-side half of author signing. The Tag Editor 0.3.0 signs what it publishes; this build checks those signatures before anything reaches your game.
Security
- A mod archive carrying a signature that does not verify is refused outright.
- The signing key's fingerprint is pinned per mod, so a later release of the same mod must come from the same author's key.
- A key that changes, disappears or is revoked raises a notice on the mod in your library rather than failing silently.
Unsigned uploads are still accepted for now — signing became available to mod authors only one release ago, and refusing everything else would lock out mods published before it existed.