manifest signature

The detached .minisig file accompanying the release manifest at the CDN. Verified by deputyctl update --check and the desktop launcher against the public key baked into every image. See Security → Update trust chain.