Please document gpg keys to verify the dependencies

We use [Dependency Verification](https://docs.gradle.org/current/userguide/dependency_verification.html) and currently there is no documentation stating which keys are safe

Could you please document this?

For example, `5.0.1` [was signed](https://repo1.maven.org/maven2/com/google/inject/guice/5.0.1/guice-5.0.1.jar.asc) using [d066c098ce1bbddfde1246b00a2496e4955cac56](https://keyserver.ubuntu.com/pks/lookup?search=d066c098ce1bbddfde1246b00a2496e4955cac56&fingerprint=on&op=index)

But `5.1.0` [was signed](https://repo1.maven.org/maven2/com/google/inject/guice/5.1.0/guice-5.1.0.jar.asc) with https://keyserver.ubuntu.com/pks/lookup?search=D5F46BC0B86AF5DC56DF58F05E975CB00C643DBF&fingerprint=on&op=index

Here are some examples of other projects documenting what key they use to sign their artifacts.

- https://github.com/qos-ch/slf4j/blob/master/SECURITY.md#verifying-contents
- https://square.github.io/okhttp/security/security/#verifying-artifacts
- https://downloads.apache.org/logging/KEYS