Rename PGP_KEYS to use appropriate extension.
Clarify download location and artifact signature.