[ASWF] Cryptographically sign releases

# Required:
------------
[X] I believe this isn't a duplicate topic
[X] This report is not related to an adapter

## Select One:

[ ] Build problem
[X] Incorrect Functionality or bug
[ ] New feature or functionality

## Description

ASWF compliance bulletin states

The project MUST cryptographically sign releases of the project results intended for widespread use, and there MUST be a documented process explaining to users how they can obtain the public signing keys and verify the signature(s). The private key for these signature(s) MUST NOT be on site(s) used to directly distribute the software to the public. If releases are not intended for widespread use, select not applicable" (N/A)."

# Optional
-----------

OpenEXR has achieved this goal, the solution the use should be checked for suitability to OpenTimelineIO, and then we should decide whether it is or is not appropriate to OTIO. If it is, we should adopt it, and if not, we should select N/A.

Start by reviewing the ASWF compliance requirement and the signing approach used by OpenEXR. Determine whether that approach is suitable for OpenTimelineIO releases and whether the releases are intended for widespread use; done means either adopting a documented signing and verification process or selecting N/A.

Written by the indexing model from the issue text.