I truly hope that this is not a pure whitelist of only the official signing keys via attestation.