If your links carry values people could tamper with, such as a timestamp, an order id or an affiliate id, you can sign them.
Anything between the two markers is replaced by a SHA-256 hash of it:
{{#sha256}}{{email}}|{{custom.affiliate_id}}|{{today}}{{/sha256}}
Everything inside is worked out first, so merge codes, custom fields and snippets all behave normally, and the hash is of the finished text.
Adding a secret:
Settings has a Signing secret. Include it inside the block as {{signing_secret}} and only somebody who knows the secret can produce a matching hash.
{{#sha256}}{{custom.order_id}}{{signing_secret}}{{/sha256}}
The secret is only ever readable inside a hash block. If you put {{signing_secret}} anywhere else in an email it prints nothing at all, so it cannot be leaked into a message by mistake.
Spaces and line breaks around the expression are ignored, so tidy formatting in the editor will not change the hash. Your receiving script rebuilds the same string with the same secret and compares the two hashes.