sign tags

currently signing does not apply to tags.

```
If you have a GPG private key set up, you can now use it to sign new tags. All you have to do is use -s instead of -a:

$ git tag -s v1.5 -m 'my signed 1.5 tag'

You need a passphrase to unlock the secret key for
user: "Ben Straub "
2048-bit RSA key, ID 800430EB, created 2014-05-04
```
see https://git-scm.com/book/en/v2/Git-Tools-Signing-Your-Work

It looks like signing just appends a signature to the annotated tag. we just need to figure out what exactly is expected to be in the buffer that we need to sign.

more links:
* [Signing tags | Github](https://docs.github.com/en/authentication/managing-commit-signature-verification/signing-tags)
* [git tag command reference](https://git-scm.com/docs/git-tag)

Start by reading the linked Git tag and signing documentation, then compare the issue's annotated-tag behavior with Git's signed-tag references. Determine the exact buffer and signature format expected before identifying the implementation entry point. Done means newly created tags can be signed and their signatures are compatible with Git verification.

Written by the indexing model from the issue text.