Publish code signing keys and signatures for Linux

Carried over from https://github.com/brave/browser-laptop/issues/197

We should publish our code signing keys and signatures so that anyone can independently verify them. See https://www.torproject.org/docs/verifying-signatures.html.en for an example of a project that does this.

I also think it’s a good idea to sign git tags.

Our current status (browser-laptop):

• we publish the Linux signing keys(used for .deb/.rpm packages)
• many of us sign commits our already (which is reflected on GitHub)

On browser-laptop, end users can check the signature on the installer / binaries:

• macOS can verify by running spctl --assess --verbose /Applications/Brave.app/. If app is signed, it should return something like this:

  /Applications/Brave.app/: accepted
  source=Developer ID
  

• Windows Authenticode signature can be checked by right clicking the installer and choosing properties. Once open, go to the Digital Signatures tab and double click on the signature. Make sure it says The digital signature is OK

[bsclifton]

@cg505 that’s a good request - I created an issue to track that here (in case you wanted to subscribe): https://github.com/brave/brave-browser/issues/3243

[cg505]

Is there any plan to sign git tags?