Please publish package signing keys

I'm working on validating the software supply chain for another project and I haven't been able to find a definitive statement about the package signing key used by the Mockito project. As a result, we're currently using rather an old version.

It looks like the packages in Maven Central are signed with key 0x689CBE64F4BC997F, which claims it belongs to @mockitoguy ... but there are no cross-signatures so just knowing the key doesn't provide any assurance.

A fairly common practice is for projects to publish a KEYS file containing the public keys used by the project, either in the repository or on the web site. Is it possible that the Mockito project could do this?

My apologies in advance if this information is already published and I just failed to find it.