No binary signing for releases (checksums only)

[brandonrc]

Problem

Release artifacts include SHA256 checksums but no cryptographic signatures. Users can verify integrity (file was not corrupted) but not authenticity (file was produced by the project maintainers). A compromised CDN or mirror could serve tampered binaries with valid checksums.

Suggested Fix

Add cosign signing to the release workflow:

1. Sign release binaries with cosign (keyless or with a stored key)
2. Publish .sig files alongside binaries
3. Document verification instructions in the installation guide

Source

Security audit, 2026-03-23.