CI: Sign the tarballs with a GPG key
The first step would be to create a dedicated key for the CI, and I would sign it for good measure and publish it in various places, including on the Heptapod website.
Upstream GitLab has a nice mixed approach for this, if I understood it correctly: the private key is downloaded from a restricted website, and is protected by a pass phrase on top of that. Therefore, it's not stored permanently in a directly usable form anywhere. Of course, the job that uses it has full access by definition, and the CI variables allow both to grab it and to use it. Still that's better than putting it directly in a CI variable.