A new signature-verification path checks managed-settings and policy-limits caches against embedded trust roots, using JWS with an x5c certificate chain and ES256. It computes age, cert-expiry, and chain-validation results, but currently only emits telemetry (tengu_signed_cache_shadow) rather than enforcing anything, as a shadow rollout of cache integrity checking.
New signed-cache shadow verification (telemetry-only)
Managed-settings and policy-limits caches are signature-checked against embedded trust roots, but only report telemetry for now.
Nothing to try yetTier: how much it should matter to you
3Useful: my rating, 1 to 5
4Signal: worth watching, 1 to 5
SettingsArea: what it touches
In DevelopmentKind: in v2.1.257,
What probably matters to youSection of the release