I added the fingerprint for my PGP key (found on public key-servers) to the Source section of the "Get" page on the
Sigil Blog, and to the first post of this Release thread.
That should allow anyone to independently verify my public key and thus the detached signatures for source archives/git tag.