I know what you mean. I have a project where I place the hash in a file called SHASUM then I have a detached GPG signature of the SHASUM file in SHASUM.sig. Both must be updated when the file is changed.
This way, your project won't harm a user if the repo is hacked. They'll know the repo has been altered without your signature.
Great idea, ill do this too