Add a TODO about using signed tags for releases.