Add info on where to get the source.

 * Also document the key-id used to sign releases (closes 1446).