docs: give the command that prints the keyring's fingerprints

README.md

@@ -30,5 +30,12 @@ Replace `runex` with any package in the table. Installing
 `shortarrow-archive-keyring` by name keeps the keyring, and the keys it
 holds up to date, after the tool is removed.
 
+To check the keyring, compare the fingerprints this prints with those on
+<https://pkg.shortarrow.jp/>:
+
+```sh
+curl -fsSL https://pkg.shortarrow.jp/apt/shortarrow-archive-keyring.gpg | gpg --show-keys
+```
+
 The design is in [ADR 0001](docs/adr/0001-package-registry.md), and how
 to run the registry in [docs/operations.md](docs/operations.md).

scripts/PublishedSite.psm1

@@ -138,6 +138,8 @@ It is maintained by <a href="https://github.com/ShortArrow">ShortArrow</a> and b
 <h2>Keys</h2>
 <p><a href="/apt/shortarrow-archive-keyring.gpg">shortarrow-archive-keyring.gpg</a> holds these public keys.
 The signing key signs the repository; the standby key takes over when the signing key has to be replaced.</p>
+<p>To check a downloaded keyring, compare the fingerprints this prints with the ones below:</p>
+<pre><code>curl -fsSL https://pkg.shortarrow.jp/apt/shortarrow-archive-keyring.gpg | gpg --show-keys</code></pre>
 <ul>
 $($keys -join "`n")
 </ul>

tests/WriteSite.Tests.ps1

@@ -88,6 +88,11 @@ Describe 'Write-Site' -Tag 'gpg' {
         $page | Should -Match 'href="/apt/shortarrow-archive-keyring.gpg"'
     }
 
+    It 'gives on the front page the command that prints the fingerprints of the downloaded keyring' {
+        [System.IO.File]::ReadAllText((Join-Path $site 'index.html')) |
+            Should -Match ([regex]::Escape('curl -fsSL https://pkg.shortarrow.jp/apt/shortarrow-archive-keyring.gpg | gpg --show-keys'))
+    }
+
     It 'puts each architecture''s own entries and the architecture-independent ones in its Packages, and the same text in Packages.gz' {
         $binary = Join-Path $site 'apt' 'dists' 'stable' 'main' 'binary-arm64'
         $text = [System.IO.File]::ReadAllText((Join-Path $binary 'Packages'))