For curious readers, to turn it on:

brew install gh echo HOMEBREW_VERIFY_ATTESTATIONS=1 >> $HOME/.zshrc brew verify gh

Downloading attestations will be quicker if you are logged in to github: gh auth login gh auth status

For a box you don't want full login privs on, you can use a GH PAT token with minimal privs.

If too slow/GitHub down:

HOMEBREW_NO_VERIFY_ATTESTATIONS=1 brew upgrade

https://docs.brew.sh/Homebrew-Security-and-Supply-Chain