Currently, we tell the maintainer to specifically ensure the absence of
the sha256sums.asc file before generating a file to sign. However, we
don't tell the user about the Windows assets tarball that we've built as
part of our Windows build process.
Instead of telling a potentially harried maintainer to be sure to do
something, let's help them out by providing a command in the
documentation that does the right thing so they can just copy and paste.
Additionally, let's pass the -b option to shasum, so that Windows
systems will read the file in binary mode, which makes verification
easier for Windows users.
There are now several pieces that can be used to automate some of the
release process. Update the documentation to reflect the newer,
easier-to-use steps. Additionally mention the need for signing the
SHA-256 hashes for integrity checking.
As part of the release process, we should close the release milestone
for the version we're releasing and move other items to a future
milestone. Add a note about this to the release howto.