We need to have a documentation page describing how driver users may validate signatures of the driver artifacts we publish. Given that the instructions are the same regardless of the API used (BSON, driver: Java synchronous, Java reactive, Scala, Kotlin synchronous, Kotlin coroutine), it seems better to have a single page for all of them. The instructions are in this comment . However, step 2 "Download and import the public key for verifying signatures" should just refer a user to https://github.com/mongodb/mongo-java-driver/releases , where we will have the information on how to download and import a verifying key for each new release, instead of laying down that info in step 2.