sign tags

currently signing does not apply to tags.

```
If you have a GPG private key set up, you can now use it to sign new tags. All you have to do is use -s instead of -a:

$ git tag -s v1.5 -m 'my signed 1.5 tag'

You need a passphrase to unlock the secret key for
user: "Ben Straub "
2048-bit RSA key, ID 800430EB, created 2014-05-04
```
see https://git-scm.com/book/en/v2/Git-Tools-Signing-Your-Work

It looks like signing just appends a signature to the annotated tag. we just need to figure out what exactly is expected to be in the buffer that we need to sign.

more links:
* [Signing tags | Github](https://docs.github.com/en/authentication/managing-commit-signature-verification/signing-tags)
* [git tag command reference](https://git-scm.com/docs/git-tag)

まず、リンクされている Git tag と署名のドキュメントを読み、次に issue の annotated-tag の動作を Git の signed-tag references と比較します。implementation entry point を特定する前に、期待される buffer と signature format を正確に特定します。新しく作成されたタグに署名でき、その署名が Git verification と互換性を持てば完了です。

索引モデルが issue の本文から書いたものです。