PGP would get you a lot. See this discussion for why https "only helps in a small way and is not enough to provide users with a reasonable level of trust that it's safe to use your software."

https://github.com/wayneeseguin/rvm/issues/3105#issuecomment...