[Docs]: Publish or point to where the GPG public key is for verification of RPM/DEB packages

[neilamoore]

Hello!

• Vote on this issue by adding a 👍 reaction
• If you want to document this feature, comment to let us know (we'll work with you on design, scheduling, etc.)

Affected area/feature

The documentation as it stands documents how to use cosign to verify release artifacts, which works great. However, the RPM and DEB artifacts are additionally GPG-signed and if GPG signature verification is done (e.g. 'rpm -K') verification will not succeed because there is no GPG public key available to verify the signature. I would expect such a GPG public key to be in the release artifacts alongside the cosign keys/signatures but it appears to be missing.

I have scoured the documentation and the repository and cannot find anything resembling a GPG public key, though I see references to a GPG private key in the '.goreleaser.yml' file.

[hslatman]

CA, CLI, KMS plugin