title: How to sign Phar packages and use Phar::getSignature() to validate their integrity?
body: <p>How can we sign Phar packages and use <a href="http://php.net/manual/en/phar.getsignature.php" rel="nofollow"><code>Phar::getSignature()</code></a> to verify that they are properly downloaded? </p>
  
  <p>Sole purpose of signing is to verify archive's integrity once it is downloaded and loaded into another PHP application (verification is done by the second application). There's no need for any extra "protection".</p>
  
  <p>Thanks.</p>