Secure software supply chain with signing and verification