1. Release tags are signed from 3.1.6 on. The public key is allowed_signers
   in this repository; see "Verify a Release" in the README.
2. 3.1.5 and earlier are unsigned. The 3.1.5 tag was created by the GitHub
   release form, which can only produce a lightweight tag and therefore carries
   no signature (#7273).
3. No functional change since 3.1.5.