Add backup repos; mention GitHub Attestations in README

README.pod

@@ -76,22 +76,37 @@ module and only want to run the tests without installing anything.
 The meta data, such as the source repository and bug tracker, is in
 I<Makefile.PL> or the I<META.*> files it creates. You can find that on
 those CPAN web interfaces, but you can also look at files directly in
-the source repository:
+the source repository: L<https://github.com/briandfoy/mojo-promise-role-higherorder>
+
+If you find a problem, file a ticket in the L<issue
+tracker|https://github.com/briandfoy/mojo-promise-role-higherorder/issues>.
+
+There are also backup repositories hosted on other services. These
+reflect the state of the main repo and exist only for redundancy:
 
 =over 4
 
-=item *	L<https://github.com/briandfoy/mojo-promise-role-higherorder>
+=item * L<https://bitbucket.com/briandfoy/mojo-promise-role-higherorder>
+
+=item * L<https://codeberg.org/briandfoy/mojo-promise-role-higherorder>
+
+=item * L<https://gitlab.com/briandfoy/mojo-promise-role-higherorder>
 
 =back
 
-If you find a problem, file a ticket in the L<issue
-tracker|https://github.com/briandfoy/mojo-promise-role-higherorder/issues>:
+=head2 GitHub Attestations
 
-=over 4
+This distribution now uses
+L<GitHub Attestations|https://github.blog/2024-05-02-introducing-artifact-attestations-now-in-public-beta/>,
+which allow you to verify that the archive file you have was made from
+the official repo.
 
-=item *	L<https://github.com/briandfoy/mojo-promise-role-higherorder/issues>
+You need a GitHub account and the L<gh tool|https://github.com/larsks/ghcli>.
 
-=back
+	# download the distro file from GitHub, MetaCPAN, or a CPAN mirror
+	$ gh auth login
+	...follow instructions...
+	$ gh attestation verify Mojo-Promise-Role-HigherOrder-1.23.tar.gz --owner briandfoy
 
 =head2 Getting help