Key should be tracked by git. It is small and should not change very often. Ensure signature has trust anchor.
Petr Menšík