Since (and including) Ocata, Infra has been maintaining a signing system for artifacts and publishing the signatures: http://docs.openstack.org/infra/system-config/signing.html We should publish these signatures as part of the release web site. Change-Id: I06c099cdf9a2068f5d41f41f51176167374b577b