Mention GPG key used for signing downloads

diff --git a/downloads/index.html b/downloads/index.html
index 7a57d0595310063f906d424bb26c29f290d94f0e..9676aed50d982156ccb530a4b6a813a092cde6e7 100644 (file)
--- a/downloads/index.html
+++ b/downloads/index.html
@@ -50,6 +50,18 @@ We also provide <a href="/docs/repositories.html">Debian and Ubuntu repositories
   to enable the work-around for older versions.
 </p>
 
+<p>
+All releases are crytographically signed with the following <a href="https://gnupg.org/">GnupG</a> key:
+<pre>
+pub   4096R/4E7160ED4AC8EE1D 2009-05-21 [expires: 2019-04-26]
+      Key fingerprint = 424E 14D7 03E7 C6D4 3D9D  6F36 4E71 60ED 4AC8 EE1D
+      uid                  Michael Stapelberg &lt;michael@stapelberg.de&gt;
+      uid                  Michael Stapelberg &lt;stapelberg@debian.org&gt;
+      uid                  Michael Stapelberg (RENT-A-GURU) &lt;michael@rent-a-guru.de&gt;
+</pre>
+Please verify all releases before using them.
+</p>
+
 <table width="100%" id="downloads">
   <thead>
   <tr>