mention release signing and the key used

1 files changed, 6 insertions, 0 deletions

diff --git a/README.gmi b/README.gmi
index ade9890..9262a12 100644
--- a/README.gmi
+++ b/README.gmi
@@ -64,6 +64,12 @@ $ go get tildegit.org/tjp/gus
 => https://tildegit.org/tjp/gus The code is hosted here on tildegit.
 => https://pkg.go.dev/tildegit.org/tjp/gus The generated documentation is on the go package index.
 
+### Verify releases
+
+Since v0.9.0, releases are signed with minisign. The signature file is included in the release downloads page, and the public key is RWSzQywJwHgjSMD0y0RXwXAGpapcMJplwbCVYQqabhAJ+NAnKAeh98Vb - this is also referenced on tjp's home page on gemini.
+
+=> gemini.ctrl-c.club/~tjp TJP's home page, which also mentions the public key used for signing gus releases.
+
 ## Contribute
 
 There's lots still to do, and contributions are very welcome!