Sign all builds

[rupertks]

(@philwo asked me to file an issue here)

It would be great if all builds were signed

At the moment release builds are signed (with .sig files etc at https://github.com/bazelbuild/bazel/releases)

But nightly builds and per-commit builds don't appear to be signed yet

Happy to do this myself if there are no objections. Looks like the release signing code is in scripts/ci/build.sh ?

[rupertks]

cc @jin