Each ref's value was set by a statement its pusher signed with their key; the signature is checked here, against the ref's current value.