Github user justinleet commented on the issue:
https://github.com/apache/metron/pull/1188
@nickwallen Not really? The key doesn't need to be in the KEYS file, but
the artifacts themselves all have to be signed. We could make it optional but
then half of the process isn't being done---
