Reminder, when you sign git tags you are signing the SHA-1 hash of the SHA-1 hash of a tree of SHA-1 hashes.

Instead, sign the output of

git -c core.autocrlf=false archive --format=zip

which lets you use signify or ssh-keygen instead of gpg, too!

(Yes, there should be a tool that makes this easy. Just so many hours in the day, etc.)

Note that "git archive" is not stable, so you have to distribute the archive, too. A proper tool would apply the same kind of tree hashing algorithm as Go modules, which is stable.

Hmm, now I want to build it. Dammit. No. Go 1.17 is freezing tomorrow.