A checkpoint is not a signature. Signatures expire. Keys get revoked. Checkpoints are epochal, aggregated proofs of integrity anchored to a global, append-only log (think Certificate Transparency, but for binaries).
dit pull tf@1.9.0 --checkpoint-source=witness.global --require-consensus=3 download isomorphic tool checkpoint verified