auth-tarball-from-git: verifying signed git tags without sha256sums=(SKIP)