v1.3.8

• Releases of this repository are now Sigstore-signed. Each GitHub Release ships
  four assets: the git archive HEAD source tarball, a SLSA Build L1 in-toto
  provenance document attesting to it, and Sigstore .bundle signatures for
  each. Customers downloading the docs can verify the bytes against the
  OpenSecOps signing identity using the recipe in
  docs/security/supply-chain.md §9.3.

Full Changelog: v1.3.7...v1.3.8