Replicant

Replicant mainly uses gpg for signing the releases.

The gpg key is also setup for the contact address, but it's use is highly discouraged as not everyone has access to that key.

Some people already used that gpg (public) key to send encrypted logs with potentially privacy sensitive information in bugreports, but as not everyone has access to that key currently only developers not participating anymore in Replicant can read such logs.

See the following for some examples of gpg usage:
https://tails.boum.org/doc/about/openpgp_keys/index.en.html

• Keys are used by the recovery to verify the installation zip.
• Keys are also used to sign apk within the Replicant image.
• Keys might also be used for generating OTA upgrades, but that is currently unused by Replicant.

See https://redmine.replicant.us/projects/replicant/wiki/ContributorsMeetingJuly2019#How-to-handle-the-various-keys-used-to-sign-releases-and-other-related-things-and-should-the-recovery-check-signatures

We should create a new issue, if it isn't created already, related to using a keyring with the public key of several Replicant developers, like it is done in Parabola with the parabola-keyring package, as is discussed at the link GNUtoo provided above.