Sign releases, use correct file formats

[TacticalCode]

Currently, I can't find any public signatures (or at least file integrity checksums) for release files.
In 2018... C'mon guys!
Even the Docker docs link here as the official release source, do you expect users to just throw random binaries from github onto their systems to handle login credentials?

Please use some form of signature to provide trust as well as file integrity.

Another issue I noticed with releases: The Linux tarball for v0.6.0 is not gzipped, although it has the ".gz" file extension.

[ghost]

"In 2019, this repository has releases without checksums or signatures..."