[PATCH] README.rst: Adapt doc about signature check to reality

The check implemented in korg-refresh-keys doesn't do any trust
checking, it only verifies that the signature is good. For that it's
enough to have the signer's certificate.
---
Hello,

this is my reaction to 𝕍𝕖𝕝𝕠𝕔𝕚𝕗𝕪𝕖𝕣 pointing out that the README wasn't
adapted in commit ff17b4fc3498 ("korg-update-pgpkeys: Make Greg KH the
trust anchor"). Instead of adapting the README to the changes in said
commit, just drop the wrong promises.

Best regards
Uwe

 README.rst | 17 +++++++----------
 1 file changed, 7 insertions(+), 10 deletions(-)

diff --git a/README.rst b/README.rst
index bbb6ed8c72a1..5bafdab3c5ea 100644
--- a/README.rst
+++ b/README.rst
@@ -24,22 +24,19 @@ You can then `gpg --import 79BE3E4300411886.asc` into your keyring.
 Refreshing keys
 ---------------
 
-First, you should assign full trust to Linus's key::
+First, you should import Konstantin's certificate, as he currently signs the
+commits in this repository:
 
-    $ gpg --edit-key 79BE3E4300411886
-    gpg> trust
-    gpg> 4
-    gpg> q
-    $ gpg --check-trustdb
+    $ gpg --import keys/E63EDCA9329DD07E.asc
+    ...
 
 Now, copy the `scripts/korg-refresh-keys` script to your `~/bin` and
 edit it according to the instructions.
 
 That script will first verify that the latest commit to the repository
-is signed by a valid key (a key directly signed by you or Linus), and
-then will run a `merge-only` import -- meaning that it will ignore any
-*new* keys added to the git repository and will only refresh keys that
-you already have imported into your keyring.
+is correctly signed, and then will run a `merge-only` import -- meaning that it
+will ignore any *new* keys added to the git repository and will only refresh
+keys that you already have imported into your keyring.
 
 Make sure to run `chmod a+x ~/bin/korg-refresh-keys` after you are done.
 
-- 
2.47.3