I produce a release event that contains the associated commit hash and the download URL for the tag.

Generally, this process is not for the consumer. Some power users will go in and verify based on provided instructions from the depths. @78ce6faa…f026307d brings in sig verification as a core part of the UX.