diff --git a/.goreleaser.yaml b/.goreleaser.yaml
new file mode 100644
index 0000000..26b0f46
--- /dev/null
+++ b/.goreleaser.yaml
@@ -0,0 +1,403 @@
+# Make sure to check the documentation at https://goreleaser.com
+release:
+  draft: true
+  replace_existing_draft: true
+
+before:
+  hooks:
+    # You may remove this if you don't use go modules.
+    - go mod tidy
+    # you may remove this if you don't need go generate
+    - go generate ./...
+builds:
+  - id: linux
+    main: ./cmd/tkey-verification
+    binary: tkey-verification
+    env:
+      - GOPROXY=https://proxy.golang.org,direct
+      - GOSUMDB=sum.golang.org
+      - CGO_ENABLED=0
+
+    goos:
+      - linux
+    goarch:
+      - amd64
+      - arm64
+    flags:
+      - -trimpath
+      - -buildvcs=false
+
+    # Custom ldflags mostly to avoid setting main.date which for some
+    # reason is default
+    ldflags:
+      -w -X main.version={{ .Version }} -buildid=
+
+  - id: darwin
+    main: ./cmd/tkey-verification
+    binary: tkey-verification
+    env:
+      - GOPROXY=https://proxy.golang.org,direct
+      - GOSUMDB=sum.golang.org
+      - CGO_ENABLED=1
+
+    goos:
+      - darwin
+    goarch:
+      - amd64
+      - arm64
+    flags:
+      - -trimpath
+      - -buildvcs=false
+
+    # Custom ldflags mostly to avoid setting main.date which for some
+    # reason is default
+    ldflags:
+      -w -X main.version={{ .Version }} -buildid=
+
+  - id: windows
+    main: ./cmd/tkey-verification
+    binary: tkey-verification
+    env:
+      - GOPROXY=https://proxy.golang.org,direct
+      - GOSUMDB=sum.golang.org
+      - CGO_ENABLED=0
+
+    goos:
+      - windows
+    goarch:
+      - amd64
+      - arm64
+    flags:
+      - -trimpath
+      - -buildvcs=false
+
+    # Custom ldflags mostly to avoid setting main.date which for some
+    # reason is default
+    ldflags:
+      -w -X main.version={{ .Version }} -buildid=
+
+universal_binaries:
+  - ids:
+      - darwin
+    replace: true
+    name_template: "tkey-verification"
+    hooks:
+      post: gon gon.hcl
+
+archives:
+  - format: tar.gz
+    allow_different_binary_count: true
+    # this name template makes the OS and Arch compatible with the results of uname.
+    name_template: >-
+      {{ "tkey-ssh-agent" }}_
+      {{- .Version }}_
+      {{- title .Os }}_
+      {{- if eq .Arch "all" }}universal
+      {{- else }}{{ .Arch }}{{ end }}
+      {{- if .Arm }}v{{ .Arm }}{{ end }}
+    # use zip for windows archives
+    format_overrides:
+    - goos: windows
+      format: zip
+    files:
+      - src: system/tkey-verification.1
+        dst: man
+        strip_parent: true
+
+nfpms:
+  # note that this is an array of nfpm configs
+  - #
+    # ID of the nfpm config, must be unique.
+
+    # Name of the package.
+    package_name: tkey-verification
+
+    # Your app's vendor.
+    vendor: Tillitis AB
+
+    # Your app's homepage.
+    homepage: https://tillitis.se/
+
+    # Your app's maintainer (probably you).
+    maintainer: Tillitis <hello@tillitis.se>
+
+    # Your app's description.
+    description: |-
+      A program to sign or verify the identity of a Tillitis TKey.
+
+    # Your app's license.
+    license: GPL 2.0
+
+    # Formats to be generated.
+    formats:
+      - apk
+      - deb
+      - rpm
+      - archlinux # Since: v1.13
+
+    bindir: /usr/bin
+
+    release: 1
+
+    section: misc
+
+    # Contents to add to the package.
+    # GoReleaser will automatically add the binaries.
+    contents:
+      - src: system/tkey-verification.1
+        dst: /usr/share/man/man1/tkey-verification.1
+        file_info:
+           mode: 0644
+
+    # Custom configuration applied only to the Deb packager.
+    deb:
+      # Lintian overrides
+      lintian_overrides:
+        - statically-linked-binary
+        - changelog-file-missing-in-native-package
+
+winget:
+  - # Name of the recipe
+    #
+    # Default: ProjectName
+    # Templates: allowed
+    name: TKeyVerification
+
+    # Publisher name.
+    #
+    # Templates: allowed
+    # Required.
+    publisher: Tillitis
+
+    # Your app's description.
+    #
+    # Templates: allowed
+    # Required.
+    short_description: "A program to sign or verify the identity of a Tillitis TKey."
+
+    # License name.
+    #
+    # Templates: allowed
+    # Required.
+    license: "GPLv2"
+
+    # Publisher URL.
+    #
+    # Templates: allowed
+    publisher_url: https://tillitis.se/
+
+    # Publisher support URL.
+    #
+    # Templates: allowed
+    publisher_support_url: "https://github.com/tillitis/tkey-verification/issues/new"
+
+    # Package identifier.
+    #
+    # Default: Publisher.ProjectName
+    # Templates: allowed
+    package_identifier: Tillitis.TKeyVerification
+
+    # # URL which is determined by the given Token (github, gitlab or gitea).
+    # #
+    # # Default depends on the client.
+    # # Templates: allowed
+    # url_template: "https://github.mycompany.com/foo/bar/releases/download/{{ .Tag }}/{{ .ArtifactName }}"
+
+    # # Git author used to commit to the repository.
+    # commit_author:
+    #   name: goreleaserbot
+    #   email: [email protected]
+
+    # # The project name and current git tag are used in the format string.
+    # #
+    # # Templates: allowed
+    # commit_msg_template: "{{ .PackageIdentifier }}: {{ .Tag }}"
+
+    # # Path for the file inside the repository.
+    # #
+    # # Default: manifests/<lowercased first char of publisher>/<publisher>/<version>
+    # path: manifests/g/goreleaser/1.19
+
+    # Your app's homepage.
+    homepage: "https://tillitis.se/"
+
+    # Your app's long description.
+    #
+    # Templates: allowed
+    description: "A program to sign or verify the identity of a Tillitis TKey."
+
+    # License URL.
+    #
+    # Templates: allowed
+    license_url: "https://github.com/tillitis/tkey-verification/blob/main/LICENSE"
+
+    # Copyright.
+    #
+    # Templates: allowed
+    copyright: "Tillitis AB"
+
+    # Copyright URL.
+    #
+    # Templates: allowed
+    #copyright_url: "https://goreleaser.com/copyright"
+
+    # Setting this will prevent goreleaser to actually try to commit the updated
+    # package - instead, it will be stored on the dist folder only,
+    # leaving the responsibility of publishing it to the user.
+    #
+    # If set to auto, the release will not be uploaded to the repository
+    # in case there is an indicator for prerelease in the tag e.g. v1.0.0-rc1
+    #
+    # Templates: allowed
+    skip_upload: true
+
+    # Release notes.
+    #
+    # If you want to use the release notes generated by GoReleaser, use
+    # `{{.Changelog}}` as the value.
+    #
+    # Templates: allowed
+    release_notes: "{{.Changelog}}"
+
+    # Release notes URL.
+    #
+    # Templates: allowed
+    #release_notes_url: "https://foo.bar/changelog/{{.Version}}"
+
+    # Tags.
+    # tags:
+    #   - golang
+    #   - cli
+
+    # Repository to push the generated files to.
+    repository:
+      # Repository owner.
+      #
+      # Templates: allowed
+      owner: tillitis
+
+      # Repository name.
+      #
+      # Templates: allowed
+      name: winget-pkgs
+
+brews:
+  -
+    # Name of the recipe
+    #
+    # Default: ProjectName
+    # Templates: allowed
+    name: tkey-verification
+
+    # NOTE: make sure the url_template, the token and given repo (github or
+    # gitlab) owner and name are from the same kind.
+    # We will probably unify this in the next major version like it is
+    # done with scoop.
+
+    # URL which is determined by the given Token (github, gitlab or gitea).
+    #
+    # Default depends on the client.
+    # Templates: allowed
+    #url_template: "https://github.mycompany.com/foo/bar/releases/download/{{ .Tag }}/{{ .ArtifactName }}"
+
+    # Allows you to set a custom download strategy. Note that you'll need
+    # to implement the strategy and add it to your tap repository.
+    # Example: https://docs.brew.sh/Formula-Cookbook#specifying-the-download-strategy-explicitly
+    #download_strategy: CurlDownloadStrategy
+
+    # Allows you to add a custom require_relative at the top of the formula
+    # template.
+    #custom_require: custom_download_strategy
+
+    # Git author used to commit to the repository.
+    commit_author:
+      name: goreleaserbot
+      email: bot@goreleaser.com
+
+    # The project name and current git tag are used in the format string.
+    #
+    # Templates: allowed
+    commit_msg_template: "Brew formula update for {{ .ProjectName }} version {{ .Tag }}"
+
+    # Folder inside the repository to put the formula.
+    folder: Formula
+
+    # Caveats for the user of your binary.
+    #caveats: "How to use this binary"
+
+    # Your app's homepage.
+    homepage: "https://tillitis.se/"
+
+    # Your app's description.
+    #
+    # Templates: allowed
+    description: "A program to sign or verify the identity of a Tillitis TKey."
+
+    # SPDX identifier of your app's license.
+    license: "GPLv2"
+
+    # Setting this will prevent goreleaser to actually try to commit the updated
+    # formula - instead, the formula file will be stored on the dist folder only,
+    # leaving the responsibility of publishing it to the user.
+    # If set to auto, the release will not be uploaded to the homebrew tap
+    # in case there is an indicator for prerelease in the tag e.g. v1.0.0-rc1
+    #
+    # Templates: allowed
+    skip_upload: true
+
+    # # So you can `brew test` your formula.
+    # #
+    # # Template: allowed
+    # test: |
+    #    assert_match version.to_str, shell_output("#{bin}/tkey-sign --version 2>&1")
+
+    # Custom install script for brew.
+    # Template: allowed
+    # Default: 'bin.install "BinaryName"'
+    install: |
+      bin.install "tkey-verification"
+      man1.install "man/tkey-verification.1"
+
+    # Repository to push the generated files to.
+    repository:
+      # Repository owner.
+      #
+      # Templates: allowed
+      owner: tillitis
+
+      # Repository name.
+      #
+      # Templates: allowed
+      name: homebrew-tkey
+
+      # Optionally a branch can be provided.
+      #
+      # Default: default repository branch
+      # Templates: allowed
+      branch: main
+
+      # Sets up pull request creation instead of just pushing to the given branch.
+      # Make sure the 'branch' property is different from base before enabling
+      # it.
+      #
+      # Since: v1.17
+      pull_request:
+        # Whether to enable it or not.
+        enabled: true
+
+        # Whether to open the PR as a draft or not.
+        #
+        # Since: v1.19
+        draft: true
+
+checksum:
+  name_template: 'checksums.txt'
+snapshot:
+  name_template: "{{ incpatch .Version }}-next"
+changelog:
+  sort:
+  filters:
+    exclude:
+      - '^docs:'
+      - '^test:'
+
diff --git a/gon.hcl b/gon.hcl
new file mode 100644
index 0000000..23dd6e4
--- /dev/null
+++ b/gon.hcl
@@ -0,0 +1,13 @@
+
+source = ["dist/tkey-verification_darwin_all/tkey-verification"]
+bundle_id = "com.tillitis.tkey-sign"
+
+apple_id {
+  username = "[email protected]"
+  password = "@keychain:[email protected]"
+  provider = "34722S433A"
+}
+
+sign {
+  application_identity = "Developer ID Application: Tillitis AB"
+}