Document the key used to sign releases

[zyga]

The debian pypi redirector [1] detects a gpg key used for signing releases. It would be easier to verify those if the project published a gpg keyring with keys that can sign upstream releases.

[1] https://pypi.debian.net/reuse/

[mxmehl]

Definitely helpful, thanks for the idea.

@carmenbianca Did you so far used your private GPG key for this, or is there a separate one?

[mxmehl]

Answering my own question: yes, we use private keys, namely @carmenbianca's (2A09F62739F6DEC8CFFCA216CD0A90F1C5CA0C92) and mine (A942CD00386B3CB26BA9BB652704E4AB371E2E92)

Any suggestions how to best document this? README?

[linozen]

Would it be OK for the core team if I included all of their public key IDs in the README?

[mxmehl]

For me that would be fine. @floriansnow @nicorikken, for you?

[carmenbianca]

Fine by me

[nicorikken]

I don't see myself singing the release in the near future so I don't think we have to include my key at this moment.