Sign releases with cosign keyless #1

Is your feature request related to a problem?

No

Describe the solution you'd like

Makes it easier to verify release integrity and maintain packages automatically like https://aur.archlinux.org/packages/mercurygram-desktop-bin

example: https://github.com/Picocrypt-NG/Picocrypt-NG/blob/main/.github/actions/sign-and-attest/action.yml

Describe alternatives you've considered

SHA hash verification

Additional context

No response