Specification for signing and verifying an OS package is missing