Sign PyPI releases

[maltfield]

Describe the bug

When a user downloads this python module using pip, there is no cryptographic authenticity or integrity validation to protect the user from a MITM attack.

Therefore, this project is making any other projects that obtain the kivymd module via pip in their build process vulnerable to a watering hole attack.

Expected behavior

A developer should have a mechanism to cryptographically verify the integrity and authenticity of kivymd when obtaining it through pip.

To Reproduce

pip install kivymd

Additional context

Possible solutions include:

1. Using the --sign argument of twine when uploading packages to PyPI

2. Publishing a cryptographically signed document (ideally using gpg) listing the hashes for all packages uploaded to PyPI, which users can then pass into pip using the --hash argument

[podraco]

It seems like a good measure.