SignPath Foundation requires a page titled "Code signing policy" that carries its attribution, names the committers, reviewers and approvers, and links the privacy policy, referenced from the project home page and the release pages.
docs/code-signing-policy.md states what is signed, the team roles taken from the repository collaborators and the maintainers team, the CI release process that SignPath-signed builds will go through, and the current status: releases up to v0.9.3 were built and signed locally with the Certum certificate. Both READMEs link to it, and publish-release.sh appends the link to the release notes it writes.
Evan Hu
fdbbf300a6