Hello Sigsum maintainers,

We are preparing offline verification of the official age v1.3.2 Windows archive using the age project's documented sigsum-verify v0.13.1 and sigsum-generic-2025-1 policy.

Our single local source-build attempt stopped because Windows Smart App Control blocked the Go toolchain's asm.exe. No sigsum-verify executable was produced. We have kept the security policy enabled and have not retried or changed the blocked file.

Could you please clarify:
1. Do you publish a Windows amd64 sigsum-verify v0.13.1 binary with valid Windows Authenticode signing, or another publisher-supported delivery method compatible with existing application-control policies?
2. If available, please identify the exact version, immutable official download, SHA-256, expected signer/timestamp, source commit and build/dependency provenance.
3. If only a newer verifier is supported, what compatibility checks are required for existing age v1.3.2 proofs and sigsum-generic-2025-1? We will not silently upgrade or drop proof verification.

We are asking about supported distribution options, not an exemption from Windows security controls. We have no evidence of a vulnerability in Sigsum. No private keys, customer files or machine/account identifiers are included.

Thank you,
Gary