Tag v5.9.0 available via git clone git://anongit.kde.org/extra-cmake-modules is not signed. It is not possible to verify who created the tag. It is not possible if the downloaded data matches the tag. Please, create GPG signed tags using 'git tag -s'. Reproducible: Always
ECM tags are signed since 5.10.0