Sign binary releases

I should sign release binaries. However, the binaries are produced on GitHub actions, and I have no way to verify that the build was completed faithfully. The best way to do this is probably with deterministic builds. However, I don't have a trusted linux box on which to build, so that's a prerequisite to signing binaries.