Thanks!
1. Not following completely to be honest, if your keys are stolen you're cooked anyway. Planing to mitigate that in other ways. Timestamps and invalidation smells complexity
2. Nothing stopping you from pointing to a tarball (I have come across thousands of apps and never seen that, though). There is also a commit tag.
3. Out of scope, I guess can use `variant` if needed, or just specify that manually to users of your application
