The release certificate pin exists in Gradle configuration, but downloaders lack a front-page verification block that they can share with AppVerifier. Publish the existing canonical GitHub signing-certificate SHA-256 alongside the actual application ID in the README and a two-line plain-text file. Add manual apksigner guidance, explain GitHub versus Google Play signing identities, and document updating both copies during deliberate key rotation.
Addresses the copyable verification-info requests in #694 and #404 together. Partially addresses #324's fingerprint-publication request; separately trusted publication outside GitHub remains a maintainer task. The description does not claim that such a channel has been provisioned or that AppVerifier's own internal database has been changed.
Validation: the README and plain-text block round-trip exactly to BITCHAT_GITHUB_RELEASE_CERT_SHA256 in gradle.properties, and the package matches app/build.gradle.kts. Reviewed AppVerifier's official documentation for package-plus-certificate-hash verification. Whitespace checks pass. This documentation change does not alter signing, APKs, runtime behavior, or private keys.
checked the copyable certificate block against the release pin and the github/play distinction. source review only; independent production-key publication is still a maintainer step.