[BUG] Intermittent GPG signature failures on windows-latest runners

Describe the bug

     _____          _
    / ____|        | |
   | |     ___   __| | ___  ___ _____   __
   | |    / _ \ / _` |/ _ \/ __/ _ \ \ / /
   | |___| (_) | (_| |  __/ (_| (_) \ V /
    \_____\___/ \__,_|\___|\___\___/ \_/
                            Wrapper-0.2.7
                           
==> Detected windows
 -> Downloading https://cli.codecov.io/latest/windows/codecov.exe
  % Total    % Received % Xferd  Average Speed  Time    Time    Time   Current
                                 Dload  Upload  Total   Spent   Left   Speed

  0      0   0      0   0      0      0      0                              0
100 10.48M 100 10.48M   0      0 78.21M      0                              0
100 10.48M 100 10.48M   0      0 78.11M      0                              0
100 10.48M 100 10.48M   0      0 78.05M      0                              0
==> Finishing downloading windows:latest
      Version: v11.2.8
 
gpg: directory '/c/Users/runneradmin/.gnupg' created
gpg: /c/Users/runneradmin/.gnupg/trustdb.gpg: trustdb created
gpg: key 806BB28AED779869: public key "Codecov Uploader (Codecov Uploader Verification Key) <security@codecov.io>" imported
gpg: Total number processed: 1
gpg:               imported: 1
==> Verifying GPG signature integrity
 -> Downloading https://cli.codecov.io/latest/windows/codecov.exe.SHA256SUM
 -> Downloading https://cli.codecov.io/latest/windows/codecov.exe.SHA256SUM.sig
 
gpg: Signature made Tue Apr 21 19:20:02 2026 CUT
gpg:                using RSA key 27034E7FDB850E0BBC2C62FF806BB28AED779869
gpg: Good signature from "Codecov Uploader (Codecov Uploader Verification Key) <security@codecov.io>" [unknown]
gpg: WARNING: This key is not certified with a trusted signature!
gpg:          There is no indication that the signature belongs to the owner.
Primary key fingerprint: 2703 4E7F DB85 0E0B BC2C  62FF 806B B28A ED77 9869
codecov.exe: FAILED
sha256sum: WARNING: 1 computed checksum did NOT match
==> Could not verify SHASUM. Please contact Codecov if problem continues
    Exiting...

To Reproduce

Not sure, we're not really doing anything out of the ordinary. This is just plain uses: codecov/codecov-action@v6.0.0 on windows-latest.

Full link to logs: https://github.com/pasteurlabs/tesseract-core/actions/runs/24805534706/job/72598654138

Start with the linked workflow at .github/workflows/run_tests.yml lines 70-76 and the full Windows runner logs. Trace the code path used by codecov-action@v6.0.0 for downloading, checksum validation, and GPG signature verification on windows-latest. Done means the intermittent checksum failure is explained and Windows runs can verify the downloaded binary successfully.