DOC/REL: update docs on how release tags are signed

CHANGELOG.rst

@@ -22,8 +22,9 @@ Changelog
   build errors when rebuilding.
 - Use ``.start`` files (PEP 829) instead of ``.pth`` files to implement editable
   wheels for Python 3.15 and later.
+- From this release onwards, SSH keys used to sign release tags.
 
-Daniele Nicolodi, Michał Górny, Ralf Gommers --- 25-08-2026.
+Daniele Nicolodi, Michał Górny, Ralf Gommers --- 07-09-2026.
 
 
 0.20.0

RELEASE.rst

@@ -5,15 +5,11 @@
 Release Process
 ===============
 
-All releases are PGP signed with one of the keys listed in ``docs/about.rst``.
-Before releasing please make sure your PGP key is listed there, and preferably
-signed by one of the other key holders.
+Releases are published as git tags, signed with either an SSH or a PGP key
+belonging to a maintainer. The signing key must be registered on GitHub so that
+GitHub shows the tag as verified.
 
-If your key is not signed by one of the other key holders, please make sure
-that the PR that added your key to ``docs/about.rst`` was approved by at least
-one other maintainer.
-
-After that is done, you may release the project by following these steps:
+You may release the project by following these steps:
 
 #. Release to the Git repository on GitHub:
 
@@ -23,36 +19,31 @@ After that is done, you may release the project by following these steps:
       #. Create ``CHANGELOG.rst`` section for the new release and fill it.
       #. The commit message should read: ``REL: set version to X.Y.Z``
 
-   #. Create a GPG-signed tag for the release:
+   #. Create a signed tag for the release:
 
       .. code-block:: console
 
          $ git tag -s X.Y.Z
 
-      The tag title should follow the ``meson-python X.Y.Z`` format, and the
-      tag body should be a plain text version of the change-log for the current
-      release.
-
-   #. Push the commit and tag to the repository:
+      This signs with your PGP key by default. To sign with an SSH key instead,
+      configure git once beforehand:
 
       .. code-block:: console
 
-         $ git push
-         $ git push --tags
-
-#. Release to PyPI:
+         $ git config --global gpg.format ssh
+         $ git config --global user.signingkey ~/.ssh/id_ed25519.pub
 
-   #. Build the Python artifacts:
+      The SSH signing key must be registered on
+      GitHub as a Signing Key for the tag to show as verified.
 
-      .. code-block:: console
-
-         $ python -m build
+      The tag title should follow the ``meson-python X.Y.Z`` format, and the
+      tag body should be a plain text version of the change-log for the current
+      release.
 
-   #. Push the artifacts to PyPI:
+   #. Push the tag to the repository:
 
       .. code-block:: console
 
-         $ twine upload dist/*
+         $ git push --tags
 
-      There is no need to GPG-sign the artifacts: PyPI no longer
-      supports uploading GPG signatures.
+#. Release to PyPI is done via trusted publishing, triggering on the tag.

docs/about.rst

@@ -49,13 +49,20 @@ supported Python versions.
 
 Distributors are recommended to fetch release sources from the
 corresponding tags on the Git repository_ or from source distributions
-on `PyPI`_. Git tags are PGP-signed with one of the following keys:
+on `PyPI`_. From ``0.21.0`` onwards, releases are published as signed tags,
+signed with either an SSH or a PGP key belonging to `@rgommers`_ or
+`@dnicolodi`_. Those signing keys can be retrieved from GitHub.
+
+Releases up to and including ``0.20.0`` are PGP-signed with one of the
+following keys:
 
 - |3DCE51D60930EBA47858BA4146F633CBB0EB4BF2|_ Filipe Laíns
 - |52BDC33FD1FBAB569D47FFA923D9E5499A08BDC5|_ Ralf Gommers
 
 .. _repository: https://github.com/mesonbuild/meson-python
 .. _PyPI: https://pypi.org/project/meson-python/
+.. _@rgommers: https://github.com/rgommers
+.. _@dnicolodi: https://github.com/dnicolodi
 
 .. |3DCE51D60930EBA47858BA4146F633CBB0EB4BF2| replace:: ``3DCE51D60930EBA47858BA4146F633CBB0EB4BF2``
 .. _3DCE51D60930EBA47858BA4146F633CBB0EB4BF2: https://keyserver.ubuntu.com/pks/lookup?op=get&search=0x3dce51d60930eba47858ba4146f633cbb0eb4bf2