There is no silver bullet for prompt injection, but `sig` addresses one of the most tricky challenges:

LLMs are dealing with a wall of text. Distinctions between trusted instructions and untrusted text are flimsy at best.

By involving the model, we can add texture to make trust boundaries clearer.

`sig` is a simple tool. The concept works like this:

- sign genuine system and user instructions
- require mutations to system prompts to be signed
- give model a tool to verify instructions are genuine
- gate critical tool usage on the model calling verify()