Merge pull request #5053 from guggero/verify-count

verify-install: add keys to repo, pin signatures to keys

docs/DOCKER.md

@@ -61,8 +61,7 @@ script in the image that can be called (before starting the container for
 example):
 
 ```shell
-⛰  docker pull lightninglabs/lnd:v0.12.0-beta
-⛰  docker run --rm --entrypoint="" lightninglabs/lnd:v0.12.0-beta /verify-install.sh
+⛰  docker run --rm --entrypoint="" lightninglabs/lnd:v0.12.1-beta /verify-install.sh v0.12.1-beta
 ⛰  OK=$?
 ⛰  if [ "$OK" -ne "0" ]; then echo "Verification failed!"; exit 1; done
 ⛰  docker run lightninglabs/lnd [command-line options]

docs/release-notes/release-notes-0.14.0.md

@@ -142,6 +142,13 @@ documentation](../psbt.md#use-the-batchopenchannel-rpc-for-safe-batch-channel-fu
 
 ## Security 
 
+* The release signature verification script [was overhauled to fix some possible
+  attack vectors and user
+  errors](https://github.com/lightningnetwork/lnd/pull/5053). The public keys
+  used to verify the signatures against are no longer downloaded form Keybase
+  but instead are kept in the `lnd` git repository. This allows for a more
+  transparent way of keeping track of changes to the signing keys.
+
 ### Admin macaroon permissions
 
 The default file permissions of admin.macaroon were [changed from 0600 to

docs/release.md

@@ -99,8 +99,7 @@ script in the image that can be called (before starting the container for
 example):
 
 ```shell
-⛰  docker pull lightninglabs/lnd:v0.12.0-beta
-⛰  docker run --rm --entrypoint="" lightninglabs/lnd:v0.12.0-beta /verify-install.sh
+⛰  docker run --rm --entrypoint="" lightninglabs/lnd:v0.12.1-beta /verify-install.sh v0.12.1-beta
 ⛰  OK=$?
 ⛰  if [ "$OK" -ne "0" ]; then echo "Verification failed!"; exit 1; done
 ⛰  docker run lightninglabs/lnd [command-line options]