Rotating GPG keys

[prdoyle]

Ok, I think I remember how this works. (@khchan)

Releases are published via OSSRH. To authorize publishing for io.vena, your user account needs to have io.vena as a "verified namespace". I did this process with pdoyle@venacorp.com.

The authentication works like this:

• The build step signs the jar with your GPG key
• The publish step uses your OSSRH user credentials (name and token)
• Your OSSRH user account is associated with an email address
• Sonatype ensures that the GPG that signed the jar is associated with that email address by looking up the GPG key in a public keyserver (mine is here).
• Sonatype ensures that the "namespace" (io.vena) you're trying to publish to is verified for your OSSRH user account.

In other words,

• Your user account has a verified email and a verified namespace
• When you attempt to publish with a given user account, you must
  • Use one of your verified namespaces
  • Sign the jar with a GPG key that is associated with your email on a public keyserver.

So... I think when we update the GPG key we'll need a new OSSRH user account too, because pdoyle@venacorp.com is no more.