Re: reproducing release tarball for 5.0.7

[Phil Pennock <zsh-workers+phil.pennock@xxxxxxxxxxxx>]

On 2014-10-12 at 18:00 +0100, Peter Stephenson wrote:
[ PGP keys for zsh ]
>
> Could do, guess we need a new key for this.

Not really: role keys only make sense if there's a bunch of process and
control around their access and some people who can validate the key who
sign it to provide trust paths to the outside world.  For open source
projects, IMO it makes more sense to just have individual maintainers
use their own keys.

I wrote this, as part of Exim's release process documentation:
  https://github.com/Exim/exim/wiki/EximReleasePolicy#release-verification
and think it's a reasonable baseline for zsh too.  Probably drop the
$project.org UID bit, since @zsh.org email addresses aren't really used
by individuals.

-Phil