Contribute to gradle-witness

[josephearl]

It appears gradle-witness may not be maintained anymore, would be nice to give it some love.

[vlsi]

Just in case you wondered, you might consider https://github.com/vlsi/vlsi-release-plugins/#checksum-dependency-plugin

Of course SBT is not that close to Gradle, however we might figure out a common denominator for declaration of "trusted artifacts"