Sign releases with PGP

[maltfield]

Description

Currently it is not possible to verify the authenticity or cryptographic integrity of the downoads from github.com because the releases are not cryptographically signed.

This makes it hard for users to safely obtain the AppImage releases, and it introduces them (and potentially their downstream users' data) to watering hole attacks.

Steps to Reproduce

1. Go to the repo page https://github.com/AppImage/appimagetool
2. Click Releases https://github.com/AppImage/appimagetool/releases
3. Click on the latest release (currently https://github.com/AppImage/appimagetool/releases/tag/1.9.1)
4. Look for the hash digest file and the signature of the hash digest file
5. ???
6. Get confused and open ticket

Expected behavior: [What you expected to happen]

A few things are expected:

1. I should be able to download the appimagetool PGP key out-of-band from popular third-party keyservers (eg https://keys.openpgp.org/)
2. I should be able to download a cryptographic signature of the release (or, better, the releases' digest file, such as a SHA256SUMS.asc file) along with the release itself
3. The downloads page itself should include a link to the documentation page that describes how to do the above two steps

Actual behavior: [What actually happened]

There's just literally no information on verifying downloads, and it appears that it is not possible to do so.

[maltfield]

For best-practices, see also:

1. https://infra.apache.org/release-signing
2. https://docs.opendev.org/opendev/system-config/latest/signing.html
3. https://wiki.debian.org/Subkeys
4. https://riseup.net/en/security/message-security/openpgp/best-practices

[TheAssassin]

appimagetool is anyway built on GitHub actions with their public runners. Signing does not really add a lot of benefit. You already need to trust GitHub along the supply chain. Downloading straight from GitHub releases is good enough.