Please consider using verified commits

[gilescope]

Given that this action is widely used and can read other security events (arguably a github flaw), it's probably worth making sure all commits are signed for added peace of mind.

[mbg]

Hi @gilescope 👋🏻

Thanks for this reasonable suggestion! We are currently working on security-hardening this action, particularly for releases and tags. I am not yet sure whether we will require all commits to be signed, but we will consider it in the context of this ongoing work.