Signed hashes for releases 
Reported by marchanton on matrix: 

> Hi everyone I posted a Q about the integrity of the binary releases listed on github here #comit:matrix.org, is there anyone who can answer?
>
> With my very limited understanding of how github releases and commit signing works it is my understanding that anyone with the credentials to "comit-botty-mc-botface" can change any release at any time, without notice, as the commit is signed using GITHUB.COM's signing keys.
>
> I do not see signed (by a lead dev) shasums of the binary releases listed anywhere.
>
> Again, how can i now with certainty verify that my executable is indeed released by the team behind comit-network?
>
> Please point out any flaw in my current understanding if there is one.