[REQUEST] Support for signed source releases

Several ASWF projects have implemented signed source releases. For instance in OpenEXR:

https://github.com/AcademySoftwareFoundation/openexr/blob/main/.github/workflows/release-sign.yml

This has a few advantages:

- immutable source release, even if the release tag gets modified after the fact
- visible SHA-256 checksum for the tarball
- ability to programmatically verify authenticity of the tarball

Unfortunately there doesn't seem to be a way to prevent the automatically generated links for unsigned .tar.gz and .zip archives from showing up.

Start by comparing the referenced OpenEXR .github/workflows/release-sign.yml workflow with OpenVDB's release configuration and reviewing how GitHub generates source archive links. Determine whether the release process can publish signed tarballs, checksums, and verification metadata while addressing the automatically generated unsigned archives. Done means the supported release artifacts and verification path are clearly defined and implemented.

Written by the indexing model from the issue text.