GPG sign releases (tags)

[Kixunil]

Please sign the releases using GPG, so that people can verify authenticity of the code.

[NicolasDorier]

@Kixunil my git commit are signed

[bitcoinbrisbane]

Could we do it via CircleCI?

[Kixunil]

@bitcoinbrisbane you shouldn't. Signing should be an explicit operation that requires the author seeing the code and keeping the key safely stored.

@NicolasDorier just realized, there's a potential problem with signed commits: someone could present you a git repository with the version tag pointing at older, vulnerable version. It's easier to verify that the tag is recent than the commit being recent, I think.