deja update verifies the checksum but not the signature

`deja update` downloads `checksums.txt` and the archive from the same GitHub release and compares sha256. That catches corruption and a truncated download. It does not catch a tampered release: whoever could replace the archive could replace the checksums next to it. The releases are already cosign-signed — the release workflow signs `checksums.txt` and attests provenance — and the client ignores all of it. Two honest options, and the choice is a product one rather than a technical one: - Verify the cosign signature in `deja update`. That means pulling sigstore libraries into a binary whose selling point is having no dependencies. - Leave the client as it is and say so plainly in SECURITY.md, so anyone who needs the stronger guarantee knows to verify manually with `cosign verify-blob`. I have written the second — the documentation gap is real either way — and left the first for a decision. Checked while I was here: `deja update` follows `releases/latest`, which excludes prereleases, so the unsigned nightly cannot be pulled by it.