SLSA

Provenance answers where this came from and how. Unverified it is metadata; checked against expectations it is a reason to refuse an artifact.