bug#66414: GNU ELPA: Require signed tags to release new package versions

[Stefan Kangas]

Stefan Monnier <monnier@iro.umontreal.ca> writes:

> The (Non)GNU ELPA tarballs are built from `elpa.git` and `nongnu.git`,
> not from the upstream repositories, and currently those do not
> contain upstream tags.
>
> And since those repos contain many packages, the upstream tags need to
> be renamed or moved to a different namespace to avoid conflicts between
> tag names in different packages.

I'm starting to wonder if Philip's idea to use signed git commits might
work better for our purposes.

Would signed tags give us something that signed commits wouldn't?