It would be nice if we could verify the authenticity of disks/images/ISOs before letting users perform installations in client applications. If the libosinfo maintainers decide to accept this feature, we would likely add extra fields to Osinfo.Media entries that would enable us to point to an URL of the GPG signature, keyring, and all, as Will Thompson suggested in https://gitlab.gnome.org/GNOME/gnome-boxes/issues/404#note_589684