E.g. any recommendations for where / how to publish or document the GPG key used for signing Java releases? https://github.com/open-telemetry/opentelemetry-java-instrumentation/discussions/13815