docs: commit the release signing certificate and fingerprint

Add the release key's public certificate (signing/release-certificate.pem)
and its SHA-256 to signing/README.md.

signing/README.md

@@ -2,8 +2,10 @@
 
 subtracks ships through four channels:
 
-- **GitHub releases** — the APK is signed with the release key. Every release
+- **GitHub releases** — the APK is signed with the release key. Its public
-  attaches the public certificate `release-certificate.pem` and a `SHA256SUMS`.
+  certificate is committed here as
+  [`release-certificate.pem`](release-certificate.pem) and attached to each
+  release, along with a `SHA256SUMS`.
 - **Google Play** — uses Play App Signing, so Google re-signs the app it
   delivers. The release key is only the *upload* key there: it signs the AAB we
   send to Play, not the APK users install. The installed app verifies against
@@ -34,7 +36,14 @@ committed at [`nightly-certificate.pem`](nightly-certificate.pem)).
 
 ## GitHub releases
 
-Each release attaches the APK, the checksums and the certificate:
+The APK is signed with the release key. Certificate SHA-256:
+
+```
+02:DA:2C:B7:B8:21:4E:53:BD:BF:B4:55:69:8D:CB:96:52:22:F9:1C:95:4B:52:10:AE:AC:96:FE:32:9C:8F:01
+```
+
+Each release attaches the APK, the checksums and the certificate (committed here
+as [`release-certificate.pem`](release-certificate.pem)):
 
 ```sh
 sha256sum -c SHA256SUMS

signing/release-certificate.pem

@@ -0,0 +1,32 @@
+-----BEGIN CERTIFICATE-----
+MIIFfTCCA2WgAwIBAgIEFf1YeTANBgkqhkiG9w0BAQwFADBvMRAwDgYDVQQGEwdV
+bmtub3duMRAwDgYDVQQIEwdVbmtub3duMRAwDgYDVQQHEwdVbmtub3duMRAwDgYD
+VQQKEwdVbmtub3duMRAwDgYDVQQLEwdVbmtub3duMRMwEQYDVQQDEwphdXN0aW5y
+aWVkMB4XDTIxMDgyMzA2MzMyMVoXDTQ5MDEwODA2MzMyMVowbzEQMA4GA1UEBhMH
+VW5rbm93bjEQMA4GA1UECBMHVW5rbm93bjEQMA4GA1UEBxMHVW5rbm93bjEQMA4G
+A1UEChMHVW5rbm93bjEQMA4GA1UECxMHVW5rbm93bjETMBEGA1UEAxMKYXVzdGlu
+cmllZDCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAPDxh5StdFjO/79y
+87/RbFoZ2H8SLqY8WPpgrAKg/DU/T+jz/S6EPIB6houZDMPs0xo0fbXU0w5iGxGw
+FBunzHucugs/iU0HfBk+XbCJDaAzxe13b/KY1y2EuaCjRanGQRqpEXspoQwEz0GZ
+VbBci/UsPlVZzoC+hxUtwfCogdvzEAPtdHogvYgC4VXhr85FBs03H91o6hRgeJBK
+kbxo2kWrl/Xd6Gz2Lu59AKTRjXD3cu7b51u6Hx5+MSpnx8V3UWdGalTrDsDzocP1
+JRnmlHG21ivlpaphZy0xMMz3EQDuEXZaZFkPDIP6KUPP7+92d/eWnWwsrB+YGBjg
+Olu1cLekzf7zjy150GtoCVe664bwZ91RP3Ih9mjqql8tJSwZGHqoYdN+isXd7ffR
+mT/elwA5ZZMLvE/JwLCd+M8Av2QA7Vusz8bJid/Ppc/5BkdgpC7uhUq233/T6j6U
+qKFrFcNLRzrRE9Av/p+ZgQRghqDH8JcZp3FYqXDq0ldeyUM0PTzmfWgYnyg+PALx
+w9b8xGP6qVxD0fL/QGj8SoRd535UjEpjNcGdmbC6QmSWPEpnq2OLfnShucKZAeUk
+qu0u+ba2WN5TX68Tp7h7kERxwggahGSTC4pPxn0c3fo7fFOVFqMhieOlRdMZV6K3
+r4RwwZs6lxThNPljxLsAOlUI36LZAgMBAAGjITAfMB0GA1UdDgQWBBTOqOVaPyDQ
+NNd1tT+8yiSq4GWH6zANBgkqhkiG9w0BAQwFAAOCAgEAHgEtVhsFCumGoRBpjyTB
+WJ4cka0BHWgIptFzBcS5DaLY+pyOT5J1LFmDYzmF5HTQdJNv+k+i+x4MUcXgg09e
+haZGJq2t8BZVrF/ynmwbaPxa81WdKCTEQYz0B+hlaAYG+c2XwTfx9TMtJv/Tg8U0
+iSUXPlOkWzv4vL8axbBizYsegjgv/L/znQHdvmoVb9GUguP+0qNqfTSkA7SF01cj
+eWfP9JhtzxV6BlEfhialiKq6hoZzwDgye1k12zNqjvAj4IiFzDyxZafBgPMZrAC8
+XkorfRoJtCAJck/EInXDre2Aosi3uQ9GoUHylHaJlpWDje3G4e9FdBBk9voVnY0u
+EaE9orgteRukzYd6jQiVIJZl+Ol9hBJQgaL2ChrVSC2DRQaTtmsBg1D+DOU8P3q0
+/P//iAcPyAYOPj9d06Vm8JATAJg4jRiomA4CddSJ8/IHNkdSgcwkU+3mpzzbnolt
+/y0z6sPxcfLb1SGNrqevOKdfpKhxb9lhgBiro7F3uu7schkrcB8MczS/pTLzjyKd
+7o4QVEehbFEG5czMX9eb1cobiTE3cnTAMuHEfSrs+WKmHot19R54zb19d3X7eyiT
+rLzCFrqjict5aA0ckZlsmh2zRO1tNoB4YkiPvgmV/kaxg1UoK7pbgN3foMTFgjph
+CbcA2PhHua2HFcHcoAwUgFI=
+-----END CERTIFICATE-----