Signing software question

I'd like to experiment with Keybase's API, and one of my first thoughts was automating the signing of GitHub release tarballs. A potential flow I was imagining is the following (here, Developer releases the code, User downloads the code):

• Developer downloads the tarball after releasing
• Signs it with keybase

    keybase pgp sign -d -i tarball-v1.tar.gz -o /Keybase/public/username/v1.asc

• User downloads tarball and can verify by running

    keybase pgp verify -d /Keybase/public/username/v1.asc -i tarball-v1.tar.gz

Of course, this whole flow can be ignored if the developer just puts the tarball into her public Keybase directory, but GitHub has much better distribution than Keybase right now if you want to share with a larger audience.

GitHub also allows you to add arbitrary files to a release. This can include a signed copy of the tarball, which I just experimented with here. But there's no API for doing that programmatically, and it requires the user to download an additional file. Plus this is just me trying to get more familiar with Keybase.

I haven't thought about the problem very deeply, so if there's a better flow I'd like to hear it! For instance, maybe this could be incorporated into Travis CI?

No source file, test, or implementation entry point is identified; begin by clarifying whether the requested work is a Keybase API, GitHub release integration, or Travis CI workflow. Define the supported signing and verification flow and acceptance criteria before implementation.