Consider adopting signed release tags

[cary-ilm]

The OpenSSF Best Practices Badge suggests signing release tags. The process is simple, described here: simply create the release from a tag created with -s:

$ git tag -s v1.2.3

The project maintainer who creates the release tags needs a GPG key. Instructions for creating a key are described here.

[jstone-lucasfilm]

Thanks for posting these ideas for security improvements, @cary-ilm, and they all sound valuable to me!