We should publish the keybase code-signing key on our Website and tell people how to verify it

Maybe provide a command-line to check it in one go with gpg. It's a little tricky though since someone distributing a compromised `keybase-installer` can still distribute the main key but still might have broken the system.

Here's something that's an incomplete solution:

``` bash
(gpg --no-default-keyring -k --keyring ~/.keybase-installer/keyring/pubring.gpg --with-colons --fingerprint 'Keybase.io Code Signing (v1) ' | grep '5379B9706C5D468C86A572B07E28EBDB26BE0E97::Keybase.io Code Signing (v1)' > /dev/null); if test $? -eq 0; then echo "GOOD"; else echo "WARNING: " ; fi
```

Start by locating the website content for installer or code-signing guidance and review the proposed GPG command in the issue. Publish the code-signing key and explain how users can verify it, while documenting the limitation that a compromised installer could still distribute the main key.

Written by the indexing model from the issue text.