Command sign manages the Ed25519 key that signs codexctl releases.
go run ./tools/sign keygen -out FILE write a private key, print the public key
go run ./tools/sign sign -out SIG FILE sign FILE with $CODEXCTL_SIGNING_KEY
go run ./tools/sign verify -key PUB -sig SIG FILE