I bundled our tarball and signature under PyPI as an afterthought. Expanding this into its own listing with FAQ instructions for how to validate.