Sign releases with GPG key

[quickfur]

As suggested by somebody on the upstream forum. Probably a necessity in this day and age of malware and trojans.

We should just generate a master signing key and use that to sign all OpenD releases, publish the public key on the website.

[adamdruppe]

Yeah, another thing I just don't know about but would like to see.

[quickfur]

It's relatively simple:

1. Generate a GPG key. Prolly look up online for a tutorial somewhere, there are some nuances you probably should think about carefully before you do it.
2. Publish the public key online, on the website or on some public keyserver (does anybody even use those anymore?!)
3. When building a release, add a command to sign the release, e.g., each binary if you distribute those separately, or just zip 'em up and sign the entire file. Publish the signature on the website.
4. That's it! When a user downloads the zipfile, he can use gpg to verify the file against the signature to ensure that it has not be tampered with in transit.