Trusted content
How the Academy proves a lab came from a publisher you trust and has not been tampered with, and what the verified-publisher badge does and does not mean.
Content you can trust
The labs in the shared catalogue are published by Invictus and its partner CyberLab, not written by every organisation on the platform. So you can tell where a lab came from, content signing is built into the platform: a publisher can cryptographically sign a lab bundle.
When a bundle is signed by a publisher the platform trusts, it verifies the signature as the content is imported. That confirms two things: the content genuinely came from that publisher, and not one byte has changed since they signed it. An operator can also require a valid trusted-publisher signature for the shared catalogue, so unsigned content is refused.
The verified-publisher badge
Your organisation's admins can also import their own lab bundles. When they do, if a bundle was signed by a publisher the platform trusts, the import names who signed it - a verified-publisher label.
An unsigned bundle, or one signed by a source the platform does not recognise, still imports and works; it simply carries no verified-publisher label. Anything your own team authors needs no signature at all - the label is there only to tell you when a bundle provably came from a trusted publisher.
Seeing it in the catalogue
Where a lab was imported from a signed bundle, its entry in the catalogue and its detail page carry a Signed by badge naming the publishing key. Most of the shipped catalogue is unsigned, so no badge is the normal case and does not indicate a problem; the badge is a positive signal, not a warning by its absence.
The badge records what was verified when the content was imported. Operators manage the set of trusted publisher keys centrally and can revoke one, which takes effect on the very next import or seed with no restart. Revoking a key does not retro-reject content that was already imported and is already running; an operator can report on what a since-revoked key signed.
What a signature does, and does not, mean
A signature proves provenance and integrity: where a lab came from, and that it is intact. It does not, by itself, mean the content is harmless.
Every lab also runs inside a locked-down, isolated sandbox, and that isolation is what actually keeps you and the platform safe. Provenance and containment are two separate guarantees, and the Academy is built to provide both - it never asks a signature to do a sandbox's job.