We should validate that the artifacts in the SBOM are part of the in-toto chain.
We should validate that the artifacts in the SBOM are part of the in-toto chain.