Sign your own binaries with go-tool-base, part 4: mint and publish your public keyMint an OpenPGP public key from a KMS-held private key you cannot hold, and publish it somewhere the release platform cannot reach.
