https://github.com/asfaload/asfaload : an opensource multisig sign-off solution allowing to sign and authenticate GitHub release artifacts. It is self hostable, accountless (key pair identity), auditable.