Document how we manage the Jenkins' artifact signing key used by isobuilders

That key expired yesterday, and I could not find any place where we document how to distribute that key, let alone manage it with Puppet. So it seems that I’ll have to distribute the updated key by hand. IMO we should do the documentation part now, and file a ticket wrt. managing it with Puppet some day.

Original created by @intrigeri on 11828 (Redmine)