ci: reject tags if not signed by Matthew Holt's key (#3932)
ci: reject tags if not signed by Matthew Holt's key (#3932)

* ci: reject tags if not signed by Matthew Holt's key

* ci: don't reject tags if an intermediate commits are not signed
l3dlp/caddy,mholt/caddy,l3dlp/caddy,mholt/caddy,l3dlp/caddy