For TUF to work the hashing/verifying has to be part of the RubyGems client and not an external library. TUF ensures *all gems* and *all metadata* are signed in some capacity.

The threshold signature system it uses is somewhat unique (Bitcoin multisignature transactions are the closest analog I can think of). For more information I suggest reading section 6.2: Multi-signature Trust in the TUF paper:

http://freehaven.net/~arma/tuf-ccs2010.pdf

Note that if you're providing a way to calculate digests of gems, that's step one of many ;) Integrating that work would be quite helpful, although it would need to be a part of RubyGems itself, not an external library.