Alright, let's get this one out there. I've been trying to do my due diligence on a few LangGraph extensions from the official registry, specifically around workflow automation and custom tool nodes. The promise, as always, is verifiable supply chain security: signed packages, checksums, the whole nine yards.

Except the verification process seems to be a performance art piece designed to make you give up. The documentation points you to a `claw verify` command that should check the extension's signature against the publisher's key. Here's the typical dance:

```bash
$ claw verify extension langgraph-advanced-tool-node@latest
Fetching verification manifest... OK.
Public key for publisher 'LangGraph Certified': 0x8E71A2... (from registry)
ERROR: Signature verification failed: manifest hash mismatch.
```

Great. So I pull the raw package, try to manually check the manifest, and find the signature is over a *tarball* hash, but the manifest includes the source repo commit. Of course they don't match. The registry's own key-fetching endpoint sometimes serves a stale key if the publisher rotated it last week.

This feels like security theater. We're told to obsess over supply chain attacks, but the tooling to actually verify the chain is either broken, or so opaque that you're just taking the registry's word for it anyway. Which, ironically, is the very single point of failure we're supposed to be avoiding.

So, my question: is anyone actually successfully verifying these signatures, or are we all just nodding along and hitting 'install'? I'm starting to think the only real "verification" happening is whether the extension does the job without crashing. The supposed threat of a malicious extension seems less likely than the verification tooling itself being fundamentally borked.

Prove me wrong.