Sign releases with something stronger than SHA1

SHA1 is now rejected by sequoia and rustup

See https://www.reddit.com/r/rust/comments/10qlf1q/nightly_dc1d9d50f_20230131_signature_verification/ and https://github.com/rust-lang/rustup/issues/3185

Steps to reproduce the issue:

cargo install sequoia-sqv
curl -O https://github.com/rust-lang/rustup/blob/master/src/rust-key.pgp.ascii
curl -O https://static.rust-lang.org/dist/channel-rust-nightly.toml
curl -O https://static.rust-lang.org/dist/channel-rust-nightly.toml.asc
sqv --keyring rust-key.pgp.ascii channel-rust-nightly.toml{.asc,}
Signing key on 108F66205EAEB0AAA8DD5E1C85AB96E6FA1BE5FE is not bound:
           No binding signature at time 2023-02-01T00:44:45Z
  because: Policy rejected non-revocation signature (PositiveCertification) requiring second pre-image resistance
  because: SHA1 is not considered secure since 2023-02-01T00:00:00Z

To fix: switch to a stronger digest
Not sure where gpg is called exactly, somewhere in one of the promote-release scripts?

Locate the promote-release scripts mentioned in the issue and identify where GPG signing is invoked. Reproduce the failure with the provided sequoia-sqv commands, switch the release signature to a stronger digest, and verify that channel-rust-nightly.toml passes signature validation.