I thought this was a good explainer on what In-toto is, when to use it, and how it's different from e.g. Sigstore:

https://nesbitt.io/2026/05/24/signing-is-for-the-bad-days.ht...