I'm still not sure what the right implementation is. We could use PGP, ssh-keygen, or roll our own signing and verification.

PGP and ssh-keygen are widely available. PGP is already commonly used to sign open source releases. However, both are complicated, with poor APIs, support for lots of weird legacy crypto systems, and use formats which seem to me to be unnecessary and weird.

I would much prefer to use:

• Plain hex instead of base64
• Actual pubkeys instead of pubkey fingerprints
• JSON instead of ASCII armor
• The BLAKE3 hash function and a single curve like secp256k1 or ed25519, as opposed to arbitrary pluggable hashes and crypto systems

Still very much unsure which path is right.