Related to #531, but need to install cosign earlier in the build, then modify scripts/release-artifacts.sh to sign the artifacts after make dist checksum