Sign ASDF releases and tags
ASDF releases could be signed with gpg. I also recommend that annotated tags are used instead of lightweight git tags; the tags themselves can also be signed.
e.g. with contents in .gitconfig
such as
[user]
name = <name>
email = <email>
signingKey = <fingerprint>
[commit]
gpgSign = true
[tag]
gpgSign = true
[push]
gpgSign = if-asked
The key could be listed in the common-lisp.net web page but also on the key servers such as https://keyserver.ubuntu.com/ and https://keys.openpgp.org/ and so on. I believe they propagate automatically so listing on one of them is enough, e.g. I find my key on https://pgp.mit.edu/ even though I never uploaded it.