Maybe use signed tags (`git tag -sa`). Requires that everyone has gpg installed though.