The staging PR should explicitly show that the tarball was successfully verified (and with which key/namespace).