Dear maintainer, Please see the attached patch which adds upstream signing key and verifies upstream release signature.