write verification instructions, and developer statement

This commit is contained in:
meejah 2020-12-20 19:09:34 -07:00
parent a031e6a4b3
commit 9957790bb8
2 changed files with 4 additions and 3 deletions

View File

@ -197,8 +197,9 @@ Verifying Signatures
--------------------
First download the source tarball and then any signatures. There are several
developers who are able to produce signatures for a release. *At least two
signatures should be found and verified*.
developers who are expected to produce signatures for a release. Thus, a
release may have more than one signature. All signatures should be valid and
you should confirm at least one signature.
This statement, signed by the existing Tahoe release-signing key, attests to
those developers authorized to sign a Tahoe release:

View File

@ -23,4 +23,4 @@ https://twistedmatrix.com/~exarkun/E27B085EDEAA4B1B.asc
brian warner
0xD43B4C9C73225AAF
967E FE06 6998 7241 1A77 DF36 D43B 4C9C 7322 5AAF
http://www.lothar.com/warner-gpg.html
https://www.lothar.com/warner-gpg.html