Add docs on how to sign GA releases

I wonder if we could also have the pulp-common package install the key?