[issue2551279] GPG support removed from pypi - rewrite pgp signature validation.

New submission from John Rouillard:

https://discuss.python.org/t/gpg-signature-support-removed-from-pypi/27014

announces removal of GPG/PGP signatures being uploaded to pypi.
The RELEASE.txt document describes how to upload it. Doc needs to be rewritten
to remove upload to PyPI and a new place for the detached signatures:

  * part of www.roundup-tracker.org doc/security.html page
  * some downloadable location (docs/release-signature/v2.3.0??)
    use the security.htm page as index to the download locations???

needs to decided on and documented.

Update directions on how to verify the source tarball located in
tools/roundup.public.pgp.key.

Also update security.txt to include the location of the roundup project public key in 
tools/roundup.public.pgp.key.

Also there is an earlier version of the key on pgp.mit.edu. It needs to be updated.
I tried this evening by uploading the pgp part of tools/roundup.public.pgp.key, but
searching immediately after still returned the key that expires in 2023 not the new key that
expires in 2028.

----------
components: Infrastructure
messages: 7777
nosy: rouilj
severity: normal
status: new
title: GPG support removed from pypi - rewrite pgp signature validation.
type: behavior

_________________________________________________
Roundup tracker <[email protected]>
<https://issues.roundup-tracker.org/issue2551279>
_________________________________________________