Add upstream-signing-key.pgp.