what if we automated that too - where each release got its own public key, signed by a per-release-gen'd private key