Download

Every release is built by a public GitHub Actions workflow.
Each file carries a signed build provenance attestation, which binds its digest to that workflow, this repository and the commit it was built from.
No signing key is stored anywhere.
With the GitHub CLI, check any file you downloaded:

gh attestation verify <file> --repo kollektiv-mc/Konnekt

Without gh, the checksums.txt published beside the binaries confirms the download arrived intact:

sha256sum -c checksums.txt

A checksum says the bytes are the ones that were published.
The attestation says who published them.
Windows builds are not code signed yet, and a first launch shows a SmartScreen warning.
Code signing is on the roadmap.