Using cosign/sigstore to sign release artifacts https://github.com/sigstore/cosign https://github.com/sigstore/cosign and instructions for validating signature

Using cosign/sigstore to sign release artifacts https://github.com/sigstore/cosign https://github.com/sigstore/cosign and instructions for validating signature on download could be a good option here.