scripts/sign-extension.mjs signs a bundle with an ed25519 author key; EXTENSIONS.md documents the format, key model, and verdict behaviors. Generated private keys live in gitignored scripts/keys/.