Add better links / info about release signing keys to Downloads & Security page

[bnvk]

While trying to verify the Qubes-R3.0-rc2-x86_64-DVD.iso I realized the signature was difference from the master signing key I had imported to my keychain. I found no mention of the key ID that shows up in . After chatting with Michael, I learned there was separate key for just release signing.

I think we can improve upon the documentation and instructions in this respect!

[unman]

There's already a link to VerifyingSignatures, where that issue is explained in some detail.
Do you mean that some of that material should be moved directly to the Download Page, or that the information on that page isn't clear enough?

[unman]

There's already a link to VerifyingSignatures, where that issue is explained in some detail.
Do you mean that some of that material should be moved directly to the Download Page, or that the information on that page isn't clear enough?

[bnvk]

@unman I think if we use unique signing keys for each release, those keys should be linked to on the Download Page. I read and now re-read the VerifyingSignatures page, the importing Qubes signing keys section does explain things, eventually. I'm used to verifying packages with one key, but have never gone through a signing verification process like this with a master signing key. White I understand the reasoning for the way it is done (and thoroughly appreciate it), it also is a lot of info to take in and follow for a mildly technical user like myself. I thinks this could be improved upon a bit!

[bnvk]

@unman I think if we use unique signing keys for each release, those keys should be linked to on the Download Page. I read and now re-read the VerifyingSignatures page, the importing Qubes signing keys section does explain things, eventually. I'm used to verifying packages with one key, but have never gone through a signing verification process like this with a master signing key. White I understand the reasoning for the way it is done (and thoroughly appreciate it), it also is a lot of info to take in and follow for a mildly technical user like myself. I thinks this could be improved upon a bit!