Added public GnuPG key and instructions about downloaded files verification.

README.md

@@ -87,6 +87,31 @@ Each tag corresponds to a Chromium Stable release tag.
 Bromite is currently built for ARM, ARM64 and x86 and for the Android SDKs versions 16 and 21
 Additionally, [SystemWebView](https://www.bromite.org/system_web_view), Monochrome and the [vanilla Chromium](https://www.bromite.org/chromium) builds are provided.
 
+## Integrity and authenticity
+
+You can verify the integrity of a downloaded APK file from this project with any `sha256sum`-compatible tool by downloading the corresponding `brm_X.Y.Z.sha256.txt` or `chr_X.Y.Z.sha256.txt` file, where X.Y.Z is the release version number. Example:
+```
+$ sha256sum --check brm_68.0.3440.54.sha256.txt
+arm64_SystemWebView.apk: OK
+arm64_ChromePublic.apk: OK
+arm64_ChromeModernPublic.apk: OK
+arm64_MonochromePublic.apk: OK
+```
+
+If you prefer an UI-based tool, you might want to look into [GtkHash](https://github.com/tristanheaven/gtkhash).
+
+You can verify authenticity, e.g. that the author ([csagan5](https://github.com/csagan5)) released the file, by using gpg2:
+```
+$ gpg2 --quiet --verify brm_68.0.3440.54.sha256.txt.asc
+gpg: assuming signed data in 'brm_68.0.3440.54.sha256.txt'
+gpg: Signature made Sun 08 Jul 2018 04:22:52 PM CEST using RSA key ID D85DC0C5
+gpg: Good signature from "csagan5 <32685696+csagan5@users.noreply.github.com>"
+```
+
+You can download csagan5's public GnuPG key from here: [csagan5.asc](./csagan5.asc).
+
+**NOTE:** releases before v68 did not have published signed hashes files.
+
 # How to build
 
 The [Bromite main repository](https://github.com/bromite/bromite) contains tags for each corresponding Chromium release (see https://chromium.googlesource.com/chromium/src.git).

csagan5.asc

@@ -0,0 +1,18 @@
+-----BEGIN PGP PUBLIC KEY BLOCK-----
+Version: GnuPG v2
+
+mQENBFphnJwBCAC1qSMaPR5Nq9sEHa9ZePwoGLFafjOBcApz7IYW7dIsQYXVUHlo
+lbBwwfFUjnnIf/wzZ42ck/QGRKJ18qA9VybWyT8as0Sz26Tmxah31vI7kzlBZCYY
+/ZER5N3onQFVVVoynYxmep5HdK7enAXOtLBOogbJ/x2Q9ITPuJ+Pv3b4R5E2ui/i
+hFAruUh+oifPBzh3fjBTTr0uvDqbsnsczQptFghKxYyJiPTblCD51Ou11a3uNt1y
+PuG1bR5jImgt33T6zjdFac6kQ2Zalxa/URU/FQPiYJ1X2J1jCgdEgRKlK70ha+oN
+mnVWhFzjecuCw180HCZh1OQho+LPWbtMFyvtABEBAAG0M2NzYWdhbjUgPDMyNjg1
+Njk2K2NzYWdhbjVAdXNlcnMubm9yZXBseS5naXRodWIuY29tPokBIgQTAQgAFgUC
+WmGcnAkQZBkKUdhdwMUCGwsCGQEAADpDB/4zlnDg1gToKqtz994jLzUM7PJOPTWa
+c8xGCj7l8BpGcCOK0fk7fOQ+bDYT0OSHZ1OCR7Gbm6ENu03wNLQ7W9Tr0uf/yDIP
+mItcFk6nYmMKPnK6bd7QWLMsT9mK6mYb02zt6Ql8D7EsWGxifQVQG85ETObhoSqw
+EH6zqZvflxJLmN+vh/Orm1ipzEvw7cjvpSloDwypjY6x9MGEE9utFcGySx726gKu
+Wmz417QZc/TpylCd1p72G9pCqv1Si+y+P9tSEdjWSM6EqEwMr5W+IJ1O6BZQ7A9p
+0l2FZqYC2WkRDJZqWiYoYltP6z1SEbbVI5rQaaVAesS1Ae8OOR9EmlK8
+=6Hsd
+-----END PGP PUBLIC KEY BLOCK-----