We could create and hash the tarball from git and compare it to the released tarball, even if it wasn't originally signed. We could even use Merkle trees (perha

We could create and hash the tarball from git and compare it to the released tarball, even if it wasn't originally signed. We could even use Merkle trees (perhaps combining with find) to ensure that individual files were unchanged. At least then we could verify that the tarball was derived from that exact git commit.