> > Do you have a list of public key fingerprints for devs that sign your artifacts? > > get an initial one built. If you have not seen this keymap, take a look : https://github.com/s4u/pgp-keys-map/blob/master/resources/pgp-keys-map.list Tom