Updated GPG Key for Signing Firefox and Thunderbird Releases

Mozilla moved to a new GPG signing subkey for certain Firefox and Thunderbird artifacts (Linux tarballs, RPM packages, checksums files) after an unencrypted copy of the previous subkey was inadvertently committed to a private GitHub repository. A review of available audit records found no evidence that the key was accessed by an unauthorized party while it was present in the repository. Access to the repository was limited to a small group within Mozilla, all of whom already had authorized access to the key through other means. Mozilla has revoked the previous signing key and added safeguards to prevent similar issues in the future.

For most users no action is required, but two cases may need attention: manual verification of GPG signatures (import the new signing key and the revocation for the old key) and use of Firefox RPM packages. Thunderbird does not provide official RPM packages, so no RPM-specific action is needed for it. For RPM users, the required steps vary by distribution: Fedora 43 and later needs no special action (dnf will prompt to confirm the new key import, with fingerprint 827E 6586 0867 9618 CD34 9F93 678E 455D 7676 7AA3); Fedora 42 and older, RHEL/Rocky/Almalinux require manually removing the old key with `sudo rpm -e --allmatches gpg-pubkey-14f26682d0916cdd81e37b6d61b7b526d98f0353`, then importing the new key with `sudo rpm --import https://packages.mozilla.org/rpm/firefox/signing-key.gpg` and running `sudo dnf clean all` (important: remove the old key before importing, or the import may falsely report success); openSUSE/SUSE distributions similarly require manual removal and import, followed by `sudo zypper refresh`.

The old key fingerprint is 14F2 6682 D091 6CDD 81E3 7B6D 61B7 B526 D98F 0353. The new signing subkey fingerprint is 827E 6586 0867 9618 CD34 9F93 678E 455D 7676 7AA3, expiring 2028-08-05. The new public key and the revocation for the previous one can be fetched from the KEY files of the latest Firefox Nightly.