A release process adds artifact attestations. Which two statements correctly describe their value and necessary use? Select 2.

1. They prove that an artifact contains no vulnerabilities or malicious code.
2. They bind an artifact digest to signed provenance about the workflow and source that produced it.
3. They allow a consumer to ignore whether the downloaded bytes match the attested digest.
4. They make dependency review and vulnerability scanning unnecessary.
5. A consumer must verify the attestation and enforce an appropriate trusted-repository/workflow policy.