Mention signature policy in readme

Document signature policy in readme. This will require changing the
workflow for merging commits, to avoid polluting the commit history with
signatures by a GitHub-controlled key.

type: documentation

README.md

@@ -22,6 +22,7 @@ For more about the project and its goals, check out [this post](https://rodarmor
   - [Shell Completion Scripts](#shell-completion-scripts)
   - [Semantic Versioning](#semantic-versioning)
   - [Unstable Features](#unstable-features)
+  - [Source Signatures](#source-signatures)
 - [Acknowledgments](#acknowledgments)
 
 ## General
@@ -85,6 +86,14 @@ are unavailable unless the `--unstable` / `-u` flag is passed, for example
 `imdl --unstable torrent create .`. Unstable features may be changed or removed
 at any time.
 
+### Source Signatures
+
+All commits to the intermodal master branch signed with Casey Rodarmor's PGP
+key with fingerprint `3259DAEDB29636B0E2025A70556186B153EC6FE0`, which can be
+found
+[on keybase](https://keybase.io/rodarmor/pgp_keys.asc?fingerprint=3259daedb29636b0e2025a70556186b153ec6fe0) and on
+[his homepage](https://rodarmor.com/static/rodarmor.pgp).
+
 ## Acknowledgments
 
 The formatting of `imdl torrent show` is entirely copied from