v1.1.0 — require-signed

verify gains a require-signed input: fail any pinned entry lacking a valid signature from a trusted key. Off by default; a policy ratchet for repos whose whole pinned set is signed. Self-tested both directions in CI (unsigned pin fails; in-run-signed + trusted pin passes).