an organizational entity signed it - and distributed the per-release public key for verification