the Signed-Releases remediation steps encourage manual manipulation of the source code archives

[junyer]

scorecard/docs/checks.md

Lines 607 to 613 in b577d79

	**Remediation steps**
	- Publish the release.
	- Generate a signing key.
	- Download the release as an archive locally.
	- Sign the release archive with this key (should output a signature file).
	- Attach the signature file next to the release archive.
	- If the source is hosted on GitHub, check out the steps [here](https://wiki.debian.org/Creating%20signed%20GitHub%20releases).

In light of CVE-2024-3094, could the Signed-Releases remediation steps not encourage manual manipulation of the source code archives? :P

FWIW, I filed this feature request for SLSA folks five months ago. Earlier today, I stopped waiting and wrote this workflow using Sigstore instead.

[github-actions]

This issue has been marked stale because it has been open for 60 days with no activity.