w.r.t phishing: a maintainer intends to publish a release, will go to their GitHub Actions build log, and will click the link in the build log. So it is not a t

w.r.t phishing: a maintainer intends to publish a release, will go to their GitHub Actions build log, and will click the link in the build log. So it is not a typical phishing scenario where one gets an email without context and clicks the link. Please let me know if I am missing something. There are also ideas about using a phone app and/or a CLI related to end-to-end encryption https://github.com/step-security/wait-for-secrets/issues/56 https://github.com/step-security/wait-for-secrets/issues/56.