Why pylock.toml includes digital attestations