switch to signing OS source releases (Git tags) with OpenSSH instead of GPG to fully phase out usage of our GPG key (public key list: allowed_signers, key rotation proof via signify: allowed_signers.sig, key rotation proof via GPG: allowed_signers.asc)