To cryptographically sign a tag, you need to have gpg installed and either have a
secret key matching your configured user/e-mail, or define user.signingkey in the
git config for your repository.
Assuming you have done this, write
git tag -s -m "description" tagname
This may still fail if gpg is unable to figure out how to prompt you for your passphrase.
In that case, verify that gpg-agent is running, and that GPG_TTY is set correctly.
You should be able to use:
export GPG_TTY=$(tty)
Failing this the symptom will be an error diagnostic like
error: gpg failed to sign the data
error: unable to sign the tag