Comment by lmm

Git has tag signing, surely there's a way to clone a specific tag and check the signature against a specific GPG key fingerprint?