This way zapstore signed the release event, later devs can proof they own the GitHub repo and then take over and sign the packages for that app.