FR: Publish .asc files for releases

Feature Request

Currently, our automation uses .sha256.txt files for integrity, but these don't ensure authenticity. Signing releases would allow pipelines to verify that binaries were genuinely produced by Firecracker maintainers.

Describe the desired solution

Provide detached .asc signatures for the release tarball or .sha256.txt manifest using the official PGP key.

Describe possible alternatives

SHA-256 hashes, verifies download integrity but not publisher authenticity.

Checks

• Have you searched the Firecracker Issues database for similar requests?
• Have you read all the existing relevant Firecracker documentation?
• Have you read and understood Firecracker's core tenets?