If you're that paranoid for your software, you can vendor the source, sign the tag with publicly-verifiable GPG key, and include some cryptographic timestamp in

If you're that paranoid for your software, you can vendor the source, sign the tag with publicly-verifiable GPG key, and include some cryptographic timestamp in the description (e.g., hash of the current Bitcoin block or something) Also, print all of that, get the legal to seal the pages, and put them into a safe.