Missing GPG key for release 1.0.0

[lbeltrame]

This is again like #7470. The GPG key is nowhere to be found:

 gpg --recv-keys 349E7309 
gpg: requesting key 349E7309 from hkp server keys.gnupg.net
gpgkeys: key 349E7309 can't be retrieved

gpg --keyserver pgp.mit.edu --recv-keys 349E7309
gpg: requesting key 349E7309 from hkp server pgp.mit.edu
gpgkeys: key 349E7309 can't be retrieved

[jryans]

Hmm, curious... I did publish the key yesterday when creating it, but the key server did give lots of errors along the way. I will try again tomorrow.

[jryans]

I still wasn't able to publish to either of the servers you listed above due to server errors. However, pool.sks-keyservers.net seems available, so the following should now work:

gpg --keyserver pool.sks-keyservers.net --recv-keys 349E7309

[ghost]

@jryans why the key change? Is the key available for download anywhere on the official websites? It should also be signed with the previous key, otherwise it's kind of pointless don't you think?

[jryans]

It's a new sub key of the main key. I am not aware of the keys being posted on website at the moment, but it seems like a reasonable thing to do.

[ghost]

But why the new sub key?

Why should I trust it? Is there any trust relationship that I can verify between the new key and the old? Can it be cryptographically confirmed it belongs to the same main key?

[jryans]

A new sub key was added because a new person ran the release process. We use a separate sub key for each person able to package a release.

You need access to the main key and its passphrase to add a sub key. When you verify the signature, GPG confirms it is chained to the main key via the sub key.

[ArchangeGabriel]

The key is available at https://github.com/RiotRobot.gpg also.