Sign all assets and Git tags in GitHub releases with Microsoft signing key

[the-gabe]

Description

I want to be able to automate package creation for Arch Linux using the Linux binaries or build from the Git tags provided, without blindly trusting the assets/tags on the GitHub releases page.

OpenSSH signatures would be preferred, GPG is largely a legacy tool with much attack surface, OpenSSH makes more sense as it now ships in every major OS has much less attack surface.