Switch release signing to an RSA-4096 key

rpm 4.14 (RHEL/CentOS/Rocky 8) cannot import an Ed25519 public key at all:
the import fails and package verification reports SIGNATURES NOT OK. RHEL 8
is supported until 2029 and is a realistic target for a signed package repo,
so the Ed25519 key excludes a large part of the rpm audience.

Publish an RSA-4096 signing key as 3proxy-release-key.asc and keep the old
Ed25519 key as 3proxy-release-key-ed25519.asc so artifacts up to 0.9.9 stay
verifiable. Workflows derive the key id from the imported secret key, so no
workflow change is needed.

3proxy-release-key-ed25519.asc

@@ -0,0 +1,10 @@
+-----BEGIN PGP PUBLIC KEY BLOCK-----
+
+mDMEaogJthYJKwYBBAHaRw8BAQdA8rZ4l90kTOSrlosP0yyeX6jFGfiFFizawjS0
+vyQnmu60KjNwcm94eSByZWxlYXNlIHNpZ25pbmcgPDNwcm94eUAzcHJveHkub3Jn
+PoivBBMWCgBXFiEEvHxfo3tIuOfF5ScUw2JYsMbAg6oFAmqICbYbFIAAAAAABAAO
+bWFudTIsMi41KzEuMTIsMCwzAhsDBQsJCAcCAiICBhUKCQgLAgQWAgMBAh4HAheA
+AAoJEMNiWLDGwIOqBHIA/iRus5VEqL+v6nYQ+GDLDUZJzMfFcnDBI+BOOhiESnTp
+AP4s3uvhigRcdutxkYwSXBlJ+7wE1yZeuUmjPoJXvgNaDw==
+=Ngp2
+-----END PGP PUBLIC KEY BLOCK-----

3proxy-release-key.asc

@@ -1,10 +1,29 @@
 -----BEGIN PGP PUBLIC KEY BLOCK-----
 
-mDMEaogJthYJKwYBBAHaRw8BAQdA8rZ4l90kTOSrlosP0yyeX6jFGfiFFizawjS0
-vyQnmu60KjNwcm94eSByZWxlYXNlIHNpZ25pbmcgPDNwcm94eUAzcHJveHkub3Jn
-PoivBBMWCgBXFiEEvHxfo3tIuOfF5ScUw2JYsMbAg6oFAmqICbYbFIAAAAAABAAO
-bWFudTIsMi41KzEuMTIsMCwzAhsDBQsJCAcCAiICBhUKCQgLAgQWAgMBAh4HAheA
-AAoJEMNiWLDGwIOqBHIA/iRus5VEqL+v6nYQ+GDLDUZJzMfFcnDBI+BOOhiESnTp
-AP4s3uvhigRcdutxkYwSXBlJ+7wE1yZeuUmjPoJXvgNaDw==
-=Ngp2
+mQINBGqIZCIBEADF3zxdMo2dvUGAlQm3aIcQiqmpLMHucvLfSK3fHtwagO8f03CO
+bEx9EfIK/U6BzLwEJ0CxyClzfvgo9COVpi5EjES9sI2LXzcgc4hGaYO0Q4Unj//0
+W/G8aarDaLF2NRKMLf07eaYGBRJjqHnmeHgOHdr+SnN0JtMSadWMHoliB8esnabz
+5CO4JabTrhwoez3DMLSgJNIod7wL6PJJv/2BeRahwNr2CjaXmzZKr/j7fc1MKLij
+bsvJ5OmLmngZr6CHDa9cBhVhiH+7RgWLCsRlEGxEv7w0afp/T0xDwNAPkGzk5ObC
+BrdXvypTAbNyUoVT8qSVJwkneZ4S0Ts4rRRNfNpaus4tsCmgyGKzsrbxvbiBOTPW
+jB/fjkgr6X9M/AQ3yGpXrwXRJrM/nSfjUyOEHXttTC9HpGt41NH/mpC4mDWa1Kxi
+FMxuo1+dw2kpDKl0Bp78IGdCo5akHwftFr8aHgmfZoGXAGJRHPAWbJGjC2ARy8yp
+QOpxba0S3VlCU6bs8MDKl6cpWItnlXcl/GD/Qc55bjLXjFv1pbn2RUSYZS+n9wDX
+64syZf3dZ/N5U4ydmybWfiLFUXqKQLtdO8QAWQGt4TSwKptTmI581/MMCTQ8qWZL
+zgFj6C/8K0SZ4lMOv+5zfc2+QOoWw7E2Ws3stEKTyWjOMm/QMJAGumqvqwARAQAB
+tCozcHJveHkgcmVsZWFzZSBzaWduaW5nIDwzcHJveHlAM3Byb3h5Lm9yZz6JAm0E
+EwEIAFcWIQT8EiFEmfzHuhz/bNwDEjhOOnOUCwUCaohkIhsUgAAAAAAEAA5tYW51
+MiwyLjUrMS4xMiwwLDMCGwMFCwkIBwICIgIGFQoJCAsCBBYCAwECHgcCF4AACgkQ
+AxI4TjpzlAsCwRAAtH3OO42yCd2B8Od4yS1yBDkaIFwEm8hF68eou6uaSDkKG8YZ
+C3DUH7qk0nXEMQu/5J6RWZKlW1C8D3AkUR9A1g54o6mUg4IL5196XsrQRdVu64YF
+nLCk17Piku1lMk+Re6bZ6uJv5UlSv8d0dvxmAYzjusyPyBC2VXy7B0CoDif6AmXt
+aw2/V6m0dRrfFo4W9mJKUqTAJcdBOKzEiQb7qLnzuwy4CB5qsvnEQTqymoCXFXzg
+VDCSKRLXnbDPbIs0TvsCmthn/w1hCgftPq4W0s7EUJBOhbrjF59+AuTb+U1wIXNR
+1+DPF+V+5RlwWjOWMlsOVGk2jaxjVY8wuaD3rE6ISJkt1pRv/WVdY984rT7Eu94J
+ZHnxPjFrb2ohFKjoBCt60kbgZbuQ6yvEma5lAF9K63gwMNNyGZvq6QWl58iouzuS
+3B9t7EwGwFstJfaXVhn/rnIHoExgxVZMbbsmXiGJyE2KcfVmlZcEi0MIyqEeBSDD
+gjpE4yVO6StBtJKfXra8rMwtsbWBw9MptPhcLvdWtN6TG0CxDyTHhdL1pSLNcwX1
+CTVpwi6+WmGogcv0WFNn5caQUpu9le/v/5qLRK08KWOH8inMJmTfpJg/9869YJuF
+vDKdzJd6jug5YQRfV/7YVC2hdSOBLvBuDpRINePrj9CKJ34qG+jRSJ5xwYk=
+=IS3Y
 -----END PGP PUBLIC KEY BLOCK-----

SECURITY.md

@@ -19,12 +19,26 @@ Release binaries are published with SHA256 checksums, an OpenPGP signature and
 a GitHub build provenance attestation.
 
 The release signing key is `3proxy-release-key.asc` in the root of this
-repository. Import it once:
+repository, an RSA-4096 key:
+
+```
+pub   rsa4096 2026-08-21 [SC]
+      FC12 2144 99FC C7BA 1CFF  6CDC 0312 384E 3A73 940B
+uid   3proxy release signing <3proxy@3proxy.org>
+```
+
+Import it once:
 
 ```
 gpg --import 3proxy-release-key.asc
 ```
 
+Releases up to and including 0.9.9 were signed with an Ed25519 key, kept as
+`3proxy-release-key-ed25519.asc` for verifying those older files. Note that
+rpm 4.14 and earlier (RHEL/CentOS 8 and older) cannot import an Ed25519 key
+and will report `SIGNATURES NOT OK`; use the RSA key and 0.9.9.1 or later on
+those systems.
+
 Checksums and the checksum file signature:
 
 ```