The CI job could be robustified to check the tag is signed by a whitelist of pgp keys too of course.