GPG sign GitHub Action created releases

[mxcl]

• [ ] Store the key securely. (@Xercesblu3 to research this)
• [ ] @jhheider to implement

Longer term storing the key in as a GitHub Secrets is not sufficient and we will need to determine something better.

Longer term we will need releases to be approved via a push notification to the devices of @mxcl and @jhheider, this will pause the actions run waiting on that in some manner.

[Xercesblu3]

Can we store it in 1pass Kingdom Vault?

[mxcl]

We may need something even more restricted TBH. However 1Pass is viable since they have tools for accessing their vaults from the command line.

[jhheider]

The two-stage build probably doesn't require pausing; just a job that runs and eventually notifies the maintainer list, and a dispatchable job that does whatever is left.