add publich GPG key that can be used for signing

OCM-RELEASES-PUBLIC.gpg

@@ -0,0 +1,16 @@
+-----BEGIN PGP PUBLIC KEY BLOCK-----
+
+mDMEZscbNRYJKwYBBAHaRw8BAQdAsECTz4/UAY+FhBHeAa8xQsRuujwhdnRS6W8Z
+c+rCmeW0hk9wZW4gQ29tcG9uZW50IE1vZGVsIChvZmZpY2lhbCBPQ00gcmVsZWFz
+ZSBzaWduaW5nIGtleSBmb3IgdGhlIE9wZW4gQ29tcG9uZW50IE1vZGVsIHByb2pl
+Y3QpIDxvcGVuLWNvbXBvbmVudC1tb2RlbEBub3JlcGx5LmdpdGh1Yi5jb20+iJkE
+ExYKAEEWIQS3WWiHjBedpgmakNvENByJSfvyOQUCZscbNQIbAwUJA8JnAAULCQgH
+AgIiAgYVCgkICwIEFgIDAQIeBwIXgAAKCRDENByJSfvyORWMAP9WA/YyrI0Bf8N+
+c7WOEj2jwRxwcBuTrfjK3xFVLsujfgD/WZtIeMjBsjZnwz6dFb0ln1HlQPsQTUgu
+Cg2DCH/RZwG4OARmxxs1EgorBgEEAZdVAQUBAQdALtl1v5MWA35IGskGIpRoyLV3
+wQT991Y4uKvmcD1681sDAQgHiH4EGBYKACYWIQS3WWiHjBedpgmakNvENByJSfvy
+OQUCZscbNQIbDAUJA8JnAAAKCRDENByJSfvyOcN/AQCdcuycLxA8UER479jnXMl3
+CS+ZfUqq6ydJuZqBbUzkCwEA5DsxY/E63m4rEwqIKKTzsYqDdna9bc+3RZuSI2jR
+TgQ=
+=VU/A
+-----END PGP PUBLIC KEY BLOCK-----

README.md

@@ -141,6 +141,10 @@ An example of how to use the `ocm` CLI in a Makefile can be found in [`examples/
 
 More comprehensive examples can be taken from the [`components`](components) contained in this repository. [Here](components/helmdemo/README.md) a complete component build including a multi-arch image is done and finally packaged into a CTF archive which can be transported into an OCI repository. See the readme files for details.
 
+## GPG Public Key
+
+The authenticity of released packages that have been uploaded to public repositories can be verified using our GPG public key. You can find the key in the file [OCM-RELEASES-PUBLIC.gpg](./OCM-RELEASES-PUBLIC.gpg) in this repository.
+
 ## Contributing
 
 Code contributions, feature requests, bug reports, and help requests are very welcome. Please refer to the [Contributing Guide in the Community repository](https://github.com/open-component-model/community/blob/main/CONTRIBUTING.md) for more information on how to contribute to OCM.