Public signup for this instance is disabled. Go to our Self serve sign up page to request an account. Report potential security issues privately
RPMs should be gpg signed just as the deb packages. Also add documentation how to verify to download page.