In Copr we use the highly optimized "remote signing" using obs-sign.

1. So first obs-sign needs to get the support for fs-verity.
2. We should observe whether mock support is worth it/needed.
3. Then we need to have a knob to allow users to build the signatures.

It seems unlikely that we would need to turn this feature on for our
infrastructure machines (or the installation, etc.) — Copr is not planned
to be a consumer of the per-file signatures ATM.