Type Alias: SignatureVerificationStatus

SignatureVerificationStatus = "verified" | "unsigned" | "invalid" | "error"

Defined in: Extensions/ExtensionManifest.ts:295

Verification status stored in the extension registry after install.

verified means integrity, not provenance. It says the package contents match the signature made by the key shipped inside the package itself — i.e. the package has not been tampered with since it was signed. Anyone can generate a keypair and self-sign, so verified alone establishes nothing about who the publisher is. Use deriveTrustTier for that.