What does a "Verified" badge on a Hugging Face commit mean for a model repository, and does it cover weight files?

On Hugging Face a Verified commit badge means the commit was GPG-signed with a key uploaded to the account whose email matches the account email; it speaks to commit authorship, not to the integrity or provenance of weight files beyond that commit. Curator correction 2026-10-23 (discovery audit record C3-B644-01; sources re-fetched 2026-10-23, excerpts re-located by curator GET): Problem: C2-B20-H3-06 says nothing in the Hub security pages read extends the Verified badge to the content of individual files. Conditions: a user deciding whether a model repo's weights come from a trusted source. Method (audit): re-read hub-docs at the pinned commit 5ef2e84 and current main. security-gpg.md defines Verified only as a verified signature on a commit and requires the signer key uploaded to the account with a matching, verified account email. But security-pickle.md (same commit, unchanged on main) goes further: it says signed commits 'guarantee the origin of the file' and suggests a signed commit from a trusted user makes loading its file 'pretty safe'. Correction (nature: missing an important statement): the HF docs do link the badge to file origin, but only as an origin claim for a file in that commit, explicitly not a safety guarantee, and still not a per-file hash or signature. Failure modes: reading 'origin' as 'content verified'; a signed commit can still add a malicious pickle; the badge says nothing about files added in later unsigned commits. Limitations: docs pages only; no behaviour of the Hub UI was observed. Version/date: hub-docs 5ef2e84 and main read 2026-10-23. Curator qualifications: Specs/docs read 2026-10-22; nothing signed or verified. HF security.md and Xet security page (no Sigstore/OMS mention) not re-read; absence claim per producer. Limitations: Specs/docs read 2026-10-22; nothing signed or verified. Evidence status: statements located in the cited sources by a correlated desk review (Claude); not executed; not independently reviewed.

{
  "citations": [
    {
      "url": "https://github.com/sigstore/model-transparency/blob/49285522a7dfe1ae6ae51f9db2b183029727325a/README.md",
      "note": "hub-docs docs/hub/security-gpg.md at 5ef2e84"
    },
    {
      "url": "https://github.com/huggingface/hub-docs/blob/5ef2e847a69e9d8ac1ebdfab02549c1468c458ac/docs/hub/security-gpg.md",
      "note": "hub-docs docs/hub/security-gpg.md at 5ef2e84"
    },
    {
      "url": "https://github.com/huggingface/hub-docs/blob/5ef2e847a69e9d8ac1ebdfab02549c1468c458ac/docs/hub/security.md",
      "note": "hub-docs docs/hub/security-gpg.md at 5ef2e84"
    },
    {
      "url": "https://github.com/huggingface/hub-docs/blob/5ef2e847a69e9d8ac1ebdfab02549c1468c458ac/docs/hub/xet/security.md",
      "note": "hub-docs docs/hub/security-gpg.md at 5ef2e84"
    },
    {
      "url": "https://raw.githubusercontent.com/huggingface/hub-docs/5ef2e847a69e9d8ac1ebdfab02549c1468c458ac/docs/hub/security-pickle.md",
      "note": "correction source (record C3-B644-01): line 178; line 180; statuses table"
    },
    {
      "url": "https://raw.githubusercontent.com/huggingface/hub-docs/main/docs/hub/security-gpg.md",
      "note": "correction source (record C3-B644-01): line 178; line 180; statuses table"
    }
  ]
}