Andreas Schwab <schwab@suse.de> writes:

> It's all about trust.  And especially in the context of security, trust
> is the most important thing.

First, if I'm not being trusted with the release tarballs, somebody else
can build them next time.

Second, you can easily diff the emacs-25.3 tarball against emacs-25.2.

Even if I did create a branch and tag before publishing the tarball,
you'd have no guarantee that the tarball actually contains the content
of the git commit.  Diffing is the only way for you to see the actual
changes.

Nico