Change PGP keys (#9046)

* automate determining the key

* update packaging docs

* switch to new keys

* add changelog entry

* put keys in changelog

certbot/CHANGELOG.md

@@ -10,7 +10,13 @@ Certbot adheres to [Semantic Versioning](https://semver.org/).
 
 ### Changed
 
-*
+* We changed the PGP key used to sign the packages we upload to PyPI. Going
+  forward, releases will be signed with one of three different keys. All of
+  these keys are available on major key servers and signed by our previous PGP
+  key. The fingerprints of these new keys are:
+    * BF6BCFC89E90747B9A680FD7B6029E8500F7DB16
+    * 86379B4F0AF371B50CD9E5FF3402831161D1D280
+    * 20F201346BF8F3F455A73F9A780CC99432A28621
 
 ### Fixed
 

certbot/docs/packaging.rst

@@ -33,9 +33,16 @@ example: `v0.11.1`.
 
 .. _`Semantic Versioning`: https://semver.org/
 
-Our packages are cryptographically signed and their signature can be verified
+Since version 1.21.0, our packages are cryptographically signed by one of three
-using the PGP key ``A2CFB51FA275A7286234E7B24D17C995CD9775F2``. This key can be
+PGP keys:
-found on major key servers and at https://dl.eff.org/certbot.pub.
+
+- ``BF6BCFC89E90747B9A680FD7B6029E8500F7DB16``
+- ``86379B4F0AF371B50CD9E5FF3402831161D1D280``
+- ``20F201346BF8F3F455A73F9A780CC99432A28621``
+
+Releases before 1.21.0 were signed by the PGP key
+``A2CFB51FA275A7286234E7B24D17C995CD9775F2``. All of these keys can be found on
+major key servers.
 
 Notes for package maintainers
 =============================

tools/_release.sh

@@ -30,7 +30,25 @@ echo Releasing production version "$version"...
 nextversion="$2"
 RELEASE_BRANCH="candidate-$version"
 
-RELEASE_GPG_KEY=${RELEASE_GPG_KEY:-A2CFB51FA275A7286234E7B24D17C995CD9775F2}
+# If RELEASE_GPG_KEY isn't set, determine the key to use.
+if [ "$RELEASE_GPG_KEY" = "" ]; then
+    TRUSTED_KEYS="
+        BF6BCFC89E90747B9A680FD7B6029E8500F7DB16
+        86379B4F0AF371B50CD9E5FF3402831161D1D280
+        20F201346BF8F3F455A73F9A780CC99432A28621
+    "
+    for key in $TRUSTED_KEYS; do
+        if gpg2 --with-colons --card-status | grep -q "$key"; then
+            RELEASE_GPG_KEY="$key"
+            break
+        fi
+    done
+    if [ "$RELEASE_GPG_KEY" = "" ]; then
+        echo A trusted PGP key was not found on your PGP card.
+        exit 1
+    fi
+fi
+
 # Needed to fix problems with git signatures and pinentry
 export GPG_TTY=$(tty)