validate a digital signature for a npm package
github.com/salesforcecli/plugin-trust
salesforcecli/plugin-trust