Please enable GPG signing of charts for verification purposes

Helm supports signing charts to allow verification of the origin and validity of a chart package. This is done through the use of provenance files.

Could signing be added to the chart release process so we can consume the signature to verify the release? We have a requirement to cache the charts locally for use, and our security team would like us to be able to verify all releases before deployment.

Helm documentation: https://helm.sh/docs/topics/provenance/

Start with the chart release process and the linked Helm provenance documentation. Determine how released chart packages can receive provenance signatures and how consumers can verify them; done means published charts include verifiable signatures.

Written by the indexing model from the issue text.