Backporting Release key README changes to nodejs/node version branches

[nschonni]

docker-node now has a script for pulling the keys from README with https://github.com/nodejs/docker-node/blob/master/update-keys.sh
I noticed that the README changes for adding the release keys doesn't appear to be backported to the branches for @richardlau addition. If the branches are kept in sync, they could be specific to the release line over in docker-node as well.

[aduh95]

Related nodejs/node#36835

[richardlau]

For my particular case, I've cherry-picked the commit for my key onto v10.x-staging (nodejs/node#36835 (comment)).

Might be worth having a discussion anyway re. policy. https://github.com/nodejs/Release/blob/master/GOVERNANCE.md#adding-new-releasers doesn't currently mention anything about a release line needing to have the key in the README for that line before a releaser can sign a release on that line.

[BethGriggs]

We discussed this in the last release WG meeting, and the suggestion was to cherry-pick the keys (or any key updates) on to all of the active release branches.

I will leave this open as a reminder to add a note to our docs.

[nschonni]

Awesome @BethGriggs!
What is the right branches to pull down keys per version? We might be able to drop the requirement for people to add to the keys.json if we can just pull and parse them out of the MD files for correct branches

[BethGriggs]

Now that we're backporting releaser's keys to all active release branches by default, it should be possible to extract the valid keys for a given release from the major release branch (vN.x). That is assuming you're always checking against the latest HEAD of those branches.

It should also be possible to extract the valid keys from the tagged version of the source, or from the source tarball download (e.g. https://github.com/nodejs/node/tree/v15.8.0#release-keys or https://nodejs.org/download/release/latest-v15.x/node-v15.8.0.tar.gz).