The single .tar.gz (or .zip) your build produced —
it already contains the signed envelope and the blob. We unpack it here;
nothing leaves your browser until you click Publish.
The TOML rubixd sign produced — package metadata plus a
[publish] block with the signature. The page refuses a bare
package TOML with no signature block.
The binary the envelope signs (ELF, docker-archive tarball, …). The same
bytes rubixd sign hashed. Use this path for a blob too
large to unpack in memory — it streams from disk.