docs: document the release signing key fingerprint (#1677)

Co-authored-by: Michael Brooks <21328+mwbrooks@users.noreply.github.com>

Author: zimeg

.github/maintainers_guide.md

@@ -120,6 +120,7 @@ These `-SNAPSHOT` versions are intended to be overwritten. This enables develope
   * Make sure there are no build failures at https://github.com/slackapi/java-slack-sdk/actions?query=branch%3Amain
 * Set a new version
   * Run `scripts/set_version.sh (the version)` (e.g., `scripts/set_version.sh 1.0.0`) — requires `gnu-sed` on macOS (`brew install gnu-sed`)
+  * If the signing key changed, update the fingerprint in [`SECURITY.md`](../SECURITY.md#verifying-releases) so the tagged commit has the new fingerprint. This is rare: the release workflow signs with the key saved as the `GPG_KEY` and `GPG_PASSPHRASE` secrets in the `central` environment, so it only changes when someone rotates those secrets
   * `git add . -v && git commit -m'version (your version here)'`
   * `git tag v(your version here)`
   * `git push && git push --tags`
@@ -131,6 +132,7 @@ These `-SNAPSHOT` versions are intended to be overwritten. This enables develope
   * Click the "Generate release notes" button to list changes grouped by the labels in [`.github/release.yml`](./release.yml)
   * Edit the resulting notes to ensure they have decent messaging that is understandable by non-contributors, but each change should still have its own line
   * [Look at previous releases](https://github.com/slackapi/java-slack-sdk/releases) and follow their layouts
+  * If the signing key changed, announce the new fingerprint in the release notes
 * (Slack Internal) Publishing the GitHub Release runs the notify job in the [release workflow](./workflows/release.yml), which posts the release internally. Check that the announcement appears.
 * (Slack Internal) Tweet? Not necessary for patch updates, might be needed for minor updates, definitely needed for
    major updates. Include a link to the GitHub Release(s).

SECURITY.md

@@ -62,3 +62,20 @@ This project follows coordinated disclosure:
 
 - Allow a reasonable timeframe for the team to investigate, develop, and release a fix before any public disclosure.
 - Researchers who follow responsible disclosure practices are eligible for recognition and bounty consideration through the Slack HackerOne program.
+
+## Verifying Releases
+
+Release artifacts published to [Maven Central](https://central.sonatype.com/namespace/com.slack.api) are signed with the following PGP key, which is published on [keyserver.ubuntu.com](https://keyserver.ubuntu.com/pks/lookup?search=0xC716D8933EE60B43B1E6B1936D5B6DF8D07BE057&op=index):
+
+```
+C716D8933EE60B43B1E6B1936D5B6DF8D07BE057
+```
+
+Releases starting with `v1.48.1` are signed with this key. If the key changes, this fingerprint is updated and the change is announced in the release notes.
+
+To verify a downloaded artifact, import the key and check the artifact against its `.asc` signature:
+
+```sh
+gpg --keyserver hkps://keyserver.ubuntu.com --recv-keys C716D8933EE60B43B1E6B1936D5B6DF8D07BE057
+gpg --verify slack-api-client-<version>.jar.asc slack-api-client-<version>.jar
+```