From 7a4bab21736a59dea7f3224f69c97f13a8d91d02 Mon Sep 17 00:00:00 2001
From: Daniel Micay <danielmicay@gmail.com>
Date: Sun, 30 Jun 2019 04:48:47 -0400
Subject: [PATCH] link to GPG signature for factory.pub too

---
 static/install.html | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/static/install.html b/static/install.html
index a6cd1f5b..775c96e9 100644
--- a/static/install.html
+++ b/static/install.html
@@ -99,11 +99,15 @@
             <p>This is the content of <code>factory.pub</code>:</p>
             <pre>untrusted comment: GrapheneOS factory images public key
 RWQZW9NItOuQYJ86EooQBxScfclrWiieJtAO9GpnfEjKbCO/3FriLGX3</pre>
+            <p>The <code>factory.pub</code> has
+            <a href="https://releases.grapheneos.org/factory.pub.asc">a detached signature</a>
+            made with the previously used GPG key</a> to verify that this is an authorized key
+            rotation. When the current signing key is replaced, the new key will be signed with
+            it.</p>
             <p>Download the factory images for the device from <a href="/releases">the releases
             page</a>.</p>
             <p>Verify the factory images using the signature:</p>
             <pre>signify -V -p factory.pub crosshatch-factory-2019.06.23.05.zip</pre>
-            <p>When this signing key is replaced, the new key will be signed with it.</p>
             <h2 id="flashing-factory-images">
                 <a href="#flashing-factory-images">Flashing factory images</a>
             </h2>