Please use gpg signed release tags

[thkoch2001]

Hi,

could you please sign your git tags with a GPG key via the "-s" option of git tag? If I can establish a trust path from my key to yours this would give me an extra level of confidence that I'm not downloading a tampered version of your code.

Thank you, Thomas Koch

[FiloSottile]

Are you suggesting a project or a personal key? I am not in the strong set, personally, but I can get someone nearby to sign me.

[phihag]

I'll have a look at proper signing as well. Since we don't build much (except for the Windows stuff), it's probably best to do on a personal level.

[FiloSottile]

We are now GPG signing the release tags!
However, my key is still not is the strong set. I'm working on it, but in Italy it is difficult...

Here are the details and fingerprint meanwhile:

pub   4096R/D977155C 2011-02-18 [expires: 2013-02-17]
      Key fingerprint = 9524 4D9F EE39 0B71 25A3  4708 3CD8 8EE0 D977 155C
uid                  Filippo Valsorda (FiloSottile) <filosottile.wiki@gmail.com>
uid                  Filippo Valsorda <filippo.valsorda@gmail.com>
uid                  Filippo Valsorda (Own site) <filosottile@pytux.it>
uid                  Filippo Valsorda (Own server) <filosottile@filosottile.info>
sub   4096R/F665357B 2011-02-18 [expires: 2013-02-17]