Update notes for submitted changes

* public GPG key should be verified before using it