Make sure all 3P direct and transient dependencies are signed

[yogilad]

All packages we provide to other teams: a. Are signed by our build pipeline. b. Do not take a dependency (directly or indirectly) on any package which is not signed