To be honest, I would have assumed the tooling would do attestation verification for me. The diffing the lockfile would be on me though.