Not sure if I'm missing something, but it looks like Commit exposes the commit signature:
but Tag does not expose the tag signature:
Is this field available on another tag-adjacent object that I'm overlooking? (I know it's available via v3). Perhaps it's an oversight on the API?
As far as I know, you are correct that this is currently not possible via GraphQL. However, I've relayed your inquiry to our internal team and if I'm incorrect, I'll let you know. Otherwise, this will be considered as a future improvement.