Commands like `timoni bundle build` and `timoni bundle apply` should have an option for verifying the signatures of the consumed modules.