See the Apache documentation about the KEYS file: https://www.apache.org/dev/release-signing.html#keys-policy If you are signing a release, please append your keys to the KEYS file.