Add docs on how to sign GA releases

I think the `gpgkey=https://some/url/gpg-key` in the repo file will automatically pull it down. We may want to create an RPM to install repo files though, similar to EPEL and Katello.