That is where signing other people's OpenPGP keys comes in, and the web of trust for those who haven't met their upstreams.

github can also modify signed tags.