Add docs on how to sign GA releases

Is the sig-hash the same for all RPMs in a build? I guess it's the sig-hash from the URL above?