TLS on the listener, mutual TLS, and signed releases. The listener speaks TLS 1.2+ given a certificate and requires a verified client certificate given a CA. A plaintext listener bound to anything but loopback is refused at config load. Releases are signed with keyless cosign and ship an SPDX SBOM; see docs/verifying.md.