We need to verify the sources from github match our local content.
We do this by building our own version of the git release (using `git
archive`) and checking the SHA-256 checksums against the local and
remote.
After that it's safe to sign the remote `tar.gz` and upload the
signature file to the release.
One caveat is that if Github upates their git release commmand, this
script will break. We'll worry about it when that happens.
This drops support for `zip` signature. I wish there was a way to
prevent the zip source code when doing a new release.
Closes#90
Mixing C code with Javascript files, what's not to love.
Simply run the following line to generate a new standard version:
```
npx standard-version --sign
```
