Module trust 

mkit trust — manage the commit-history allowed-signers file that mkit verify --trusted cross-checks a commit/remix/tag’s signer against.

mkit trust add <keyid> <pubkey-hex> [--kind ed25519|p256-sec1|secp256k1|bls12381-thr]
               [--trust-roots <path>] [--force]
mkit trust list [--trust-roots <path>] [--json]
mkit trust remove <keyid> [--trust-roots <path>] --yes

The file is the same [[trust_root]] TOML format mkit verify-attest --trust-roots already reads (see commands/trust_roots.rs) — one registry, shared by DSSE attestation verification and commit/remix/tag signer verification, keyed by the TrustRoot type mkit-attest already exposes. Path defaults to the user-scoped $XDG_CONFIG_HOME/mkit/trust-roots.toml; an in-repo path is refused unless passed explicitly via --trust-roots (same hostile-clone defense as verify-attest, see docs/THREAT-MODEL.md §5).

Functions

run