bit settled the model on weblib-viewer#19: the builder signs an APK, and
this repo only distributes it -- the same signature has to work whether the
APK reached a device via a git release or via F-Droid, and fdroid update
never creates a signature of its own. sign-apk.sh remains for a consumer
whose build genuinely produces an unsigned artifact, but action.yml's
header comment and the README's "Using it" example no longer show it as a
default-flow step, and both now say explicitly that this repo is never
handed an app signing key -- only the repo index key.
Also records two decisions that had nowhere to live yet: the index key's
config/secret names must stay distinct from the APK key's even while both
resolve to the same keystore for now (bit intends to split them later), and
the index key must be generated as RSA 4096, overriding F-Droid's own docs,
which suggest 2048.
Fixes#9.
Co-authored-by: bit <bit@das-labor.org>
claudeandbit