Bump version to 4.0.0.rc5 and make the release script less human-error-prone.
Ensure that tags are signed with the right key.
Expand documentation section about cryptographic verification.
[ci:skip]