model providers should start signing their responses so we know we're not getting counterfeit stuff from interfaces like openrouter