This task will involve adding the ability to generate a signature for a specific version and verify them during the build - we only want this to apply to packages identified as public API.

Animal Sniffer seems a good candidate http://www.mojohaus.org/animal-sniffer/

Generation of a signature we can likely make on-demand as we only really need that at the point we tag a release.

We would definitely want checking to run for CI PR processing but can decide if all builds should be checking with an option to disable or all disabled with an option to enable.