You are not logged in.
A PKGBUILD signature is not part of the established procedure, but can be easily added. There is no catch-22. You don't need a crypto-hash for the signature, SKIP is perfectly fine for that. You don't have to verify the integrity of the signature, that happens automatically during the PKGBUILD verification. You could also manually add the signature file with e.g. bsdtar just before you upload the archive (mkaurball does something similar for .AURINFO)
A signature for the whole archive is also possible, but you'll have to use a separate distribution channel (e.g. you own website, github, ...) to provide it to the users.
A while ago I was experimenting with signing an AUR upload. It is actually possible to append a signature of a tar file to the end of the tar file (keeping the old EOF block intact as a marker), although I guess it is a bit of a hack. This way the signature is embedded in the file and there is no separate distribution channel. Some code, with a bit of explanation at the top: <https://github.com/vadmium/pacman-tools … akeaur#L16>.
Offline