I do. Deploys can only be rolled out if the tag was signed by a well known list of people (git pull --verify-signatures).