Git has tag signing, surely there's a way to clone a specific tag and check the signature against a specific GPG key fingerprint?
Tag signatures are mostly worthless now from a crypto point of view -- with the caveat that you can still get some value from them if you still trust sha1 to be secure against second-preimage attacks.
git checkout 0.1.0
git tag -v 0.1.0