How safe are signed git tags? Only as safe as SHA-1 or somehow safer?