...

For more information on creating a signing key, visit How to OpenPGP and Signing Releases

SBT PGP

The sbt-pgp plugin is required to publish signed releases. Add the following to the file ~/.sbt/1.0/pgp.sbt to enable usage of the plugin:

addSbtPlugin("com.jsuereth" % "sbt-pgp" % "1.1.1")

In most cases, no other configuration should be necessary–the plugin should automatically find and use the signing key created above.

Checkout the Apache Dist Repository

...

released: false
artifact-root: "https://dist.apache.org/repos/dist/dev/incubator/daffodil/2.0.0-rc1/"
checksum-root: "https://dist.apache.org/repos/dist/dev/incubator/daffodil/2.0.0-rc1/"
key-file: "https://dist.apache.org/repos/dist/dev/incubator/daffodil/KEYS"
 
 

Follow the steps in the README in that repository to publish the new release page.

...