Github cannot be trusted with releases.
We're slowly fixing this, making good progress with the developer signing tool.
To which I'm adding an option to upload to a Blossom server to completely bypass the dependency on Github.
Will be sharing a preview next week.
