The current way of getting gancio is or from npm registry or from framagit. In one case we put the trust in any of those hosting providers. I will prefer to be able to verify directly that the source code I download is being produced by the gancio team.
How do you feel about signing the releases? I guess the easiest will be to use an openpgp key or a dedicated one for gancio or the one of the main developer. If signing the tgz of the releases is not an option I will be also ok with the version tags being signed.