We include examples of the provenance format in the docs but when generating an .intoto.jsonl file the provenance is wrapped in a DSSE envelope and base64 encoded so it's not totally clear how to view it.

We should provide a simple command users can run on the file to view the provenance json.