Releases are signed, but lockfiles are not commonly used for this purpose. For your home env you'll usually want the latest version of every tool.

When installing tools, or via mise.toml, you can define version ranges with the precision you'd like - "3" / "3.1" / "3.1.2".