Utilize the infrastructure provided in dotnet/arcade#16034 to sign the archives (zips/tarballs) with a detached signature and publish the signature files as part of official builds.
https://github.com/dotnet/release/issues/1077 will specify the which certificate to sign with.