Change Linux signing key via keyring package

details in https://github.com/brave/devops/issues/361

Note that this involves:

1. Rotating the key (details in issue above)
2. Updating the linux install documentation to show the new key

QA steps (only needs to be done on Linux):

1. For each linux platform, download the key that is linked in https://brave-browser.readthedocs.io/en/latest/installing-brave.html#linux in the Release Channel section (for instance https://brave-browser-apt-release.s3.brave.com/brave-core.asc)
2. Import the downloaded key into gpg: gpg --import /path/to/downloaded/file
3. Run the command gpg --list-keys $KEY_ID where KEY_ID is the ID of the key that you just imported. This should be displayed in the terminal output from step 2.
4. There should be no keys that show rsa2048, only rsa4096.

[bkero]

@Mikaela Hi there. Thank you for reporting this. Yesterday when the 0.58.9 dev build was released it was signed with the wrong key, as you’ve discovered. I just resigned the packages and put them up for you to use. Please report back if you experience any issues.

[fmarier]

Edit: to clarify this system has had Brave installed previously, but didn’t have it for weeks/months and today I decided to install it again.

My guess as to what’s happening is that you installed Brave prior to our changing the installation instructions and fixing the key update mechanism. If that’s the key, there would have been an old key in /etc/apt/trusted.gpg on your machine (instead of the new location of /etc/apt/trusted.gpd.d/brave-browser-release.gpg). This will have been cleaned up automatically in the upgrade of brave-keyring and as long as you keep that package up-to-date, you shouldn’t run into the same problems again.