Git repo should use signed tags

[graingert]

Because of the security implications of this type of software, signed tags should be used to verify the source of the released software.

You'll want to use a GPG key with strong transitive trust from a key published on an Estonian government website.