Go ahead and prep your downvote, but please stop re-inventing pgp. _loud sigh_.

There’s something to be said to have the same pgp key sign a contributor license agreement, that pgp key signs the commits, that pgp signs the release artifacts, same key with an ssh subkey accesses build servers. Using key base we can see what keys control related Social media and emails.

Honestly the _only_ thing missing of an immutable chain for releases hashes.

Now get off my lawn.