From the evidence package root:
python3 verify.py
openssl ts -verify -data MANIFEST.json -in timestamp/manifest.tsr -CAfile timestamp/cacert.pem -untrusted timestamp/tsa.crt

The timestamp attests that the manifest digest existed by the signed time. It does not independently authenticate authorship or the asserted publication time.
