The way releases are currently signed depends on a single, personal key.

We need a mechanism that allows us to sign releases in a secure way without directly attaching it to an individual person.

Current thoughts:
A. Have a key attached to a general email, like releases@wp-cli.org that does not belong to one single person. The private key should be shared amongst maintainers, and the email should forward to the maintainers group.
B. Have a signing bot that is in possession of the signing private key, with personal keys giving access to that bot.

Not sure what the best/most practical approach is here, so open for feedback.