Ask an external notary for the hash of any tarball that we download from github releases

[alsuren]

After talking to my housemate about threat models, I don't think that storing signatures on a server that I control really closes any attack vectors. It might be interesting to ask an external notary to tell us the hash of the tarball from github-releases when we download it. We could then know whether it has ever changed.

The phrase that google uses for this is "binary transparency" - they write things to an append-only log. See https://transparency.dev/ and https://www.sigstore.dev/ for details.