[glib: 1/2] docs: Add a note about git-evtag to SECURITY.md

[Philip Withnall <pwithnall src gnome org>]

commit b8160ce18b60cd5dfe04ee369f3a8f80dceee0aa
Author: Philip Withnall <philip tecnocode co uk>
Date:   Tue Sep 7 11:21:12 2021 +0000

    docs: Add a note about git-evtag to SECURITY.md

 SECURITY.md | 11 +++++++++++
 1 file changed, 11 insertions(+)
---
diff --git a/SECURITY.md b/SECURITY.md
index 3505b2abf..e49460a1f 100644
--- a/SECURITY.md
+++ b/SECURITY.md
@@ -17,6 +17,17 @@ Under GLib’s versioning scheme, stable release series have an *even* minor
 component (for example, 2.66.0, 2.66.1, 2.68.3), and development release series
 have an *odd* minor component (2.67.1, 2.69.0).
 
+## Signed Releases
+
+The git tags for all releases ≥2.58.0 are signed by a maintainer using
+[git-evtag](https://github.com/cgwalters/git-evtag). The maintainer will use
+their personal GPG key; there is currently not necessarily a formal chain of
+trust for these keys. Please [create an issue](https://gitlab.gnome.org/GNOME/glib/-/issues/new)
+if you would like to work on improving this.
+
+Unsigned releases ≥2.58.0 should not be trusted. Releases prior to 2.58.0 were
+not signed.
+
 ## Reporting a Vulnerability
 
 If you think you've identified a security issue in GLib, GObject or GIO, please