doc/release-process.md says the artifact-signing public key MUST be
committed to the repo at release-pubkey.asc so verifiers can confirm
signatures. This was a documented gap that was never closed.
The key in question is the Krystie Triangles Release key (fingerprint
523A 8183 3EB7 2015 73E1 EFE1 DCF2 5799 6810 7984), which signs the
release artifacts in CI. v6.1.5 (and v6.1.4) artifacts were already
signed by this key; verifiers can now confirm against the key in
this file.
Verifying a v6.1.5 artifact:
gpg --import release-pubkey.asc
gpg --verify SHA256SUMS.asc
The maintainer's tag-signing key (Sami personal, 0x0BF7F8872FE0E859)
is NOT published here on purpose: that key is exported only to
release-pubkey.asc backup files (Sami's Dropbox / local backups).
The doc explains the two-key model.
Sami Ahmed