OMS Signing Proves Model Integrity, Not Model Provenance

The OpenSSF Model Signing (OMS) 1.0 spec confirms a model's files match what was signed, but not who trained it or on what data. Nvidia has signed every model in its NGC Catalog since March 2025, and Google is prototyping the same approach on Kaggle.

• OMS 1.0 shipped in April 2025, built on the Sigstore Bundle Format
• Nvidia has signed all NGC Catalog models since March 2025
• Training data and hardware metadata in a bundle is self-reported
• OpenSSF is preparing a separate model lifecycle provenance framework