docs/howto: update invocation for signing assets
docs/howto: update invocation for signing assets

Currently, we tell the maintainer to specifically ensure the absence of
the sha256sums.asc file before generating a file to sign. However, we
don't tell the user about the Windows assets tarball that we've built as
part of our Windows build process.

Instead of telling a potentially harried maintainer to be sure to do
something, let's help them out by providing a command in the
documentation that does the right thing so they can just copy and paste.

Additionally, let's pass the -b option to shasum, so that Windows
systems will read the file in binary mode, which makes verification
easier for Windows users.

github/git-lfs,github/git-lfs,github/git-lfs