Signing packages in CI

[lazka]

From what I see we could make github sign packages in CI via https://pypi.org/project/sigstore/ and then verify the signature before signing them via gnupg and pushing them to the repo.

Not sure if that's worth it.

It would make sure that the files we add to the repo were generated by a CI workflow of msys2/msys2-autobuild.