gpg signatures for release tarballs?

["Anonymous" <hyperowl@...>]

You only publish release checksums. The resulting scheme is weak: I need
to trust HTTPS which is security theatre given how vulnerable CAs are.
Please consider publishing cryptographic signatures of some kind
(gpg/signify/whetever).