A few notes. A release is not, indeed, a formal requirement. At this point, in practical terms, the 'requirement' is a vote from the Incubator Project Management Committee.
On the other hand, my fellow mentors, when they brought me into the picture, felt that a release would be a good capstone to moving River into an active state that would easily get a positive outcome from the IPMC. As for the web of trust: see http://www.apache.org/dev/release-signing.html. It would be more better if one of you could work out a way to get your key signed by someone else around the foundation, but that is not a prerequisite of a release. While an in-person meeting is considered idea, it's not required.
