Please make your GPG (public) signing keys available somewhere attributable to the project

The project that I work on has some defences in place against supply chain attack, this requires that any code we either deploy or use during our product release process has to be signed by a verifiable signature. See [here ](https://shibboleth.atlassian.net/wiki/spaces/DEV/pages/3269918721/Supply+Chain+Defence+for+the+Shibboleth+Java+Products)for the details

I am currently refreshing our dependencies and I see that version 3.1 is signed with GPG key [0x340B090F727518D8](https://keyserver.ubuntu.com/pks/lookup?search=0x340B090F727518D8&fingerprint=on&op=index)

It is extremely helpful to developers everywhere that software can be verified as coming from you. In our case we cannot move forward important dependencies without it. I would therefore be grateful if you could upload all your public keys to your git repository (or any of the other places noted in the link above).

Thank you

Rod

Start by reviewing the j2objc repository and the linked supply-chain guidance to determine where project-owned public GPG keys can be published. Done means the project's signing keys are available in an attributable repository location or another documented project-controlled location, including the key used for version 3.1.

Written by the indexing model from the issue text.