Good idea, in general. If I distribute a ZIP or gz or whatever with everything in it, I can provide a matching pgp sig file. But I wonder if it would be a good idea to have sig files for individual .pm files, since those can be checked after the stuff has been installed.