Sign Release Files for Verification?

[3knight]

Adding a signature to release files would allow users to verify that they are installing a genuine, unaltered copy of Helix. This would improve security for users/maintainers. Currently, I do not see a way to verify releases outside of auditing the code itself, which is a huge ask, especially for people who don't have the ability too. Please correct me if I am wrong.