To quote the author:
This series adds a stage pre-load before launching an image. This stage
is used to read a header before the image and this header contains the
signature of the full image. So u-boot may check the full image before
using any data of the image.
The support of this header is added to binman, and a command verify
checks the signature of a blob and set the u-boot env variable
"loadaddr_verified" to the beginning of the "real" image.
The support of this header is only added to binman, but it may also be
added to mkimage.