Description
In addition to signed release and tags, we may check for signed commits.
We need a good story around key management/storage. Long-term, it would be nice to suggest more recent algorithms such as ECDSA/EdDSA instead of RSA/DSA and more recent crypto libraries, such as Tink.