Use GPG to sign releases so we don't have to trust GitHub / Microsoft
### Problem Description

I cannot verify that [the release](https://github.com/cake-tech/cake_wallet/releases) I download from Github was created by you.

### Proposed Resolution

Use GPG to sign each release **_or_** provide a signed list of file hashes and / or a `.sig` file for each file released.

Bonus points:

**Strategies for helping users establish the authenticity of a GPG key:**

Ideally, the PGP key should be cross-signed with others in the OpenPGP Web of Trust Strong Set / or other prominent devs in the space (eg Monero Core devs or others in related tech like Tor, Tails, Qubes, Bitcoin, etc) 

If the release signing key is also used on at least some commits, that would establish that "_the person writing code_" also "_created this release_".  Would be much better if all devs at least signed each other's keys too.