download: detail the signing keys

We have gone through three different release managers, so there are a variety of GPG signing keys used over different periods of time.

Signed-off-by: Daniel P. Berrangé berrange@redhat.com