Java driver includes this in every release note in Github
## Verifying artifact signatures Please refer to https://www.mongodb.com/docs/drivers/java/sync/current/security/validate-signatures/ for the full procedure. To download and import the public key for verifying signatures, execute```bash gpg --keyserver hkps://keyserver.ubuntu.com --recv-keys 1a75005e142192223d6a7c3b76e0008d166740a8 ```
We need the same for Hibernate, though probably pointing to a different location.
It's easy to do in release.yml.