Supported signed releases

[brarcher]

Produce signed releases (as supported by GitHub) and attach the resulting asc file to releases such that users and package maintainer can verify a package's origin.

[lundmar]

I've recently added support for signing releases of tio (http://tio.github.io) as part of the process of getting it into Debian. Along the way I've found the following quick instructions helpful:

https://keyring.debian.org/creating-key.html
https://help.github.com/articles/telling-git-about-your-gpg-key/
https://wiki.debian.org/Creating%20signed%20GitHub%20releases

Needless to say, it is important to upload your public key. I'm told the sks key servers are the preferred trusted servers.