According to anonym on https://redmine.tails.boum.org/code/issues/16476#note-23:

1. The command now used on this branch:

       git fetch origin "${GIT_REF}"

   … will not overwrite a previously existing Git tag, while the command
   used previously:

       git fetch --tags

   … would.

2. This is only a problem when we replace a tag as part of the regular release
   process, when using keeprunning or rescue. This can be solved with "rake
   vm:destroy" but having to discover that during the release process could
   be too stressful. The goal of this branch is to avoid developers wasting
   their time and having headaches, not to create more situations in which
   that will happen.

So let's document explicitly what one MUST NOT do.