Sign all assets and Git tags in GitHub releases with Microsoft signing key

### Description

I want to be able to automate package creation for Arch Linux using the Linux binaries or build from the Git tags provided, without blindly trusting the assets/tags on the GitHub releases page.

OpenSSH signatures would be preferred, GPG is largely a legacy tool with much attack surface, OpenSSH makes more sense as it now ships in every major OS has much less attack surface.

No files, tests, or release entry points are named. Start by locating the workflow that builds and publishes GitHub release assets and tags, then verify how signing can use the requested Microsoft key. Done means every release asset and Git tag has a verifiable signature using the chosen signing method.

Written by the indexing model from the issue text.