Function signing 

pub fn signing<T>(
    signer: Rc<dyn Fn(&[Vec<String>], bool) -> String>,
    f: impl FnOnce() -> T,
) -> T

Runs f with signer signing every command step built meanwhile on this thread (its token): a host that runs commands signs only the steps speccoder itself builds, never JSON from elsewhere.