I'm not sure what you're referring to. My Keybase release contains KBFS, and I'm pretty confident it came from the releases page.

The latest release on the github releases page at the moment is v1.0.22 from May. Trying to use e.g. chat from this version will give you:

▶ ERROR failed to open chat conversation: KBFS client wasn't found

You probably installed via instructions at https://keybase.io/docs/the_app/install_linux which will get you 1.0.27.

We don't use GitHub releases for our official packages. Instead (if you're on Linux) we publish Debian/RPM/Arch packages that update automatically through your system package manager. See the install instructions here: https://keybase.io/docs/the_app/install_linux

I prefer to use the packages provided by my OS (Arch) for anything security sensitive (like keybase!) rather than a binary package from the AUR.

The official arch package is stuck on 1.0.22 waiting for you to make a tag on github.

That's partly true, but it also uses a build script that doesn't include the KBFS or GUI bits, which isn't directly under our control. At some point I'll work with the Arch maintainer to figure out what we want the official packages to be, but for now the easier control we have over the AUR package has been convenient. (It's shocking how much easier it was to get our Arch packaging working, compared to deb/rpm.)

Security-wise, you could verify our signature on the .deb package that aur/keybase-bin is downloading. The Linux install instructions describe where to find the sigs.

What about people not using those distros? Some want to package it for other distros, but it requires you to tag releases.

I'd recommend doing the same thing we do in Arch: repackaging binaries from the .deb packages. We release Linux builds almost daily (if the CI tests are happy), and I worry it would be silly for us to tag the repo at that rate.

It's not silly at all! Please do!

It's in a separate repo: https://github.com/keybase/kbfs