Add info about which signing keys will be used for published artifacts.

### Add info about which signing keys will be used for published artifacts.

For security purposes, it would be great if you were able to publish the gpg public keys that are "valid" for use when verifying signing artifacts uploaded to maven central.

This allows for "out of band" verification of the expected signing key.

Some examples of other libs publishing their signing keys:

https://square.github.io/okhttp/security/security/#verifying-artifacts

https://github.com/eclipse/jetty.project/blob/jetty-10.0.x/KEYS.txt
https://downloads.apache.org/commons/KEYS
https://downloads.apache.org/logging/KEYS

Start by reviewing the repository's existing documentation and the Maven Central publishing setup; the issue does not name a file or test. Done means the project publishes the valid GPG public signing keys in a stable, discoverable location for out-of-band verification of artifacts.

Written by the indexing model from the issue text.