Release tags are signed and verifiable
An unsigned tag proves nothing about who cut the release. Anyone with write access, or anyone who takes it, can point a tag at any commit. Forge verification reflects keys and identities registered with that forge and differs by signature format, so the portable evidence comes from git itself against a maintainer-controlled trust source.
Observable check
after git fetch --tags and importing the maintainer's published signing key, git tag -v <tag> on the newest release tag succeeds, and git cat-file -t <tag> prints tag, which means the tag is annotated rather than lightweight.