v0.4.1

Fixed

• install.sh now checks the release's signature with cosign v2 (2.4 or newer) as well as v3. With
  cosign v2 it stopped with "the Sigstore signature does not verify" although the release was
  genuine: the signatures are Sigstore bundles that cosign v2 reads only with --new-bundle-format,
  which the script now adds. With an older cosign it names the version it needs instead. The README
  and docs/verifying-releases.md now say which cosign versions work, and what to add with v2.
  (#141)

Verify the download as described in Verifying releases.

What's Changed

• Check release signatures with cosign v2 as well by Gorka Gonzalo (@d0ubl3g) in #142
• Prepare 0.4.1 by Gorka Gonzalo (@d0ubl3g) in #143
• Release 0.4.1 by Gorka Gonzalo (@d0ubl3g) in #144

Full Changelog: v0.4.0...v0.4.1