Verifiable Releases

**Is your feature request related to a problem? Please describe.**
I would like to be able to verify that the released jar file that I download is the one that you intended to release, that there has been no man-in-the-middle attack.

**Describe the solution you'd like**
The ideal solution, in my opinion, is the one described [here](https://wiki.debian.org/Creating%20signed%20GitHub%20releases). Which basically entails that the distributor downloads the file after release, verifies that it is indeed the one you intended to release, create a signature and upload that signature alongside the released jar file.

**Describe alternatives you've considered**
The common solution is to add a hash of the released artifact, which definitely improves security, but in the case where an attacker has access to change the artifact, they might also have access to change the published hash, at which point the scheme fails. Which is why a signature based on a verifiable public key is preferable.