Consider adopting signed release tags

[cary-ilm]

The OpenSSF Best Practices Badge suggests signing release tags. The process is simple, described here: simply create the release from a tag created with -s:

$ git tag -s v1.2.3

The project maintainer who creates the release tags needs a GPG key. Instructions for creating a key are described here.