readme

README.md

@@ -419,6 +419,8 @@ The analysis was mentioned in [hal-04652991](https://hal.science/hal-04652991/do
 
 - **Commits** are signed with PGP keys, to prevent forgery. Make sure to verify commit signatures
 - **Releases** are transparent and built on GitHub CI. Make sure to verify [provenance](https://docs.npmjs.com/generating-provenance-statements) logs
+  - You can verify standalone built files using github CLI:
+    `gh attestation verify --owner paulmillr noble-hashes.js`
 - **Rare releasing** is followed to ensure less re-audit need for end-users
 - **Dependencies** are minimized and locked-down: any dependency could get hacked and users will be downloading malware with every install.
   - We make sure to use as few dependencies as possible