Sign the dist as the last step before creating the archive. Take care not to modify/regenerate dist meta files or the manifest.

Error: gpg: Signature made Sat 06 Jan 2024 05:16:12 PM JST gpg: using RSA key 67263E5D9FAF5EBA gpg: Can't check signature: No public key ==> BAD/TAMPERED signature detected! <==

Add all modules contained in this distribution to the META.yml field 'provides'. Module::Build or Dist::Zilla::Plugin::MetaProvides do this automatically for you.