Document signature verification (gpg, pgp) #2042

This ticket is a request to clearly document how users of signal-cli can verify their downloaded copy of your software cryptographically before using it.

Expected behaviour

When I go to download the signal-cli release, I should also see instructions on how to verify the authenticity of the file after download and before install. Or, at least, a link to the document that describes this.

Actual behaviour

I see no mention about cryptographic authenticity verification on the release page nor the README

• https://github.com/AsamK/signal-cli/releases/tag/v0.14.3
• https://github.com/AsamK/signal-cli/blob/5bfb0442454d912e877ec008e0648bc6bc01a79e/README.md

Steps to reproduce

1. Go to https://github.com/AsamK/signal-cli
2. Click "Releases" https://github.com/AsamK/signal-cli/releases
3. Click on the latest release
4. Look for information about how to verify the cryptographic authenticity of the release
5. ???
6. Get confused and open ticket

Solution

Two things should happen:

1. signal-cli should write a documentation page that describes [a] how users can download the Official Release Signing PGP Key and [b] how users can verify a given signal-cli release using this key
2. This documentation's permalink should be linked-to in various places (eg the README, the release page, the wiki, etc)