ci: add workflow to verify commits touching key files

[aduh95]

Enforcing that commits touching key files are signed with that specific key have several upsides:

• it simplifies the check whether the releaser GitHub account knows about the key.
• it's a stronger indication of the releaser approval (mostly relevant for the case they're not already the author of the commit).