Add docs on how to sign GA releases

it refers to any 3.y.z release but it should just be "(3)".

It is the same style as https://fedoraproject.org/keys