Signatures of release jars on Maven Central cannot be verified

Description

On Maven central, the files generated by an Appium release build (like for example java-client-7.1.0.jar) are signed as they also have to be in the corresponding .asc file (like java-client-7.1.0.jar.asc).
These signatures are signed by a PGP key with the key id 0xA3955233E7FD6A68 but this key is not available on the key servers.

So the problem is, the files are signed, but no one can verify the signatures. This especially also leads to errors in the pgpverify-maven-plugin (see https://github.com/s4u/pgpverify-maven-plugin ), as it can't verify the signatures.

I assume when the PGP key was created for Travis CI, it was not uploaded to a keyserver (I don't know which howto was followed, but basically this step is missing: https://github.com/osmlab/atlas/wiki/Gradle,-Travis-CI-and-Maven-Central#broadcast-your-public-key ). You could also provide the public key here for us to verify.

Steps To Reproduce Issue

How it usually works (example for JUnit, which works fine):

• download junit-4.12.jar and junit-4.12.jar.asc from https://repo1.maven.org/maven2/junit/junit/4.12/
• run 'gpg --verify junit-4.12.jar.asc', it will probably fail because the key is not yet imported, but show the key id like 'EFE8086F9E93774E' (this is the one for JUnit)
• import the key from the keyserver with 'gpg --keyserver pgp.mit.edu --recv-keys EFE8086F9E93774E'
• now 'gpg --verify junit-4.12.jar.asc' can actually verify that the jar file has not been modified since it was built and signed

Reproduce the problem with Appium java-client:

• download java-client-7.1.0.jar and java-client-7.1.0.jar.asc from https://repo1.maven.org/maven2/io/appium/java-client/7.1.0/
• run 'gpg --verify java-client-7.1.0.jar.asc', which shows the key is A3955233E7FD6A68
• try to import the key from the keyserver with 'gpg --keyserver pgp.mit.edu --recv-keys A3955233E7FD6A68'
• this fails because it doesn't find the key, nor do other keyservers like pool.sks-keyservers.net

This should work like with all other jars on Maven central, once the public key A3955233E7FD6A68 is properly published to the keyservers.

Start by downloading java-client-7.1.0.jar and its .asc file from Maven Central and rerun the listed gpg verification and key-import commands for A3955233E7FD6A68. Review the Travis CI release-signing setup and the referenced key-publication guidance. Done means the public key is available from keyservers and the artifact signature can be verified.