sign tags

currently signing does not apply to tags.

```
If you have a GPG private key set up, you can now use it to sign new tags. All you have to do is use -s instead of -a:

$ git tag -s v1.5 -m 'my signed 1.5 tag'

You need a passphrase to unlock the secret key for
user: "Ben Straub "
2048-bit RSA key, ID 800430EB, created 2014-05-04
```
see https://git-scm.com/book/en/v2/Git-Tools-Signing-Your-Work

It looks like signing just appends a signature to the annotated tag. we just need to figure out what exactly is expected to be in the buffer that we need to sign.

more links:
* [Signing tags | Github](https://docs.github.com/en/authentication/managing-commit-signature-verification/signing-tags)
* [git tag command reference](https://git-scm.com/docs/git-tag)