release: verify bundled Tor signatures

2 files changed, 11 insertions, 6 deletions

diff --git a/docs/release-verification.md b/docs/release-verification.md
index 04d18a3..b8eaf5e 100644
--- a/docs/release-verification.md
+++ b/docs/release-verification.md
@@ -83,9 +83,11 @@ key in `verify-release.sh`.
 
 For Windows releases with managed Tor built in, run `make windows-tor`. It
 creates `Bitflash-*-windows-with-tor.zip` by downloading the Tor Expert Bundle,
-checking the pinned SHA256 in `scripts/package-windows-tor.sh`, and placing
-`tor/tor.exe` next to `Bitflash.exe`. Include that zip in `SHA256SUMS` like any
-other release asset.
+checking the pinned SHA256 in `scripts/package-windows-tor.sh`, optionally
+verifying the Tor Project `.asc` signature, and placing `tor/tor.exe` next to
+`Bitflash.exe`. For release builds, run `TOR_VERIFY_GPG=required make
+windows-tor` so the signature check is mandatory. Include that zip in
+`SHA256SUMS` like any other release asset.
 
 ## Why this matters
 
diff --git a/docs/tor.md b/docs/tor.md
index be6a145..a408704 100644
--- a/docs/tor.md
+++ b/docs/tor.md
@@ -65,9 +65,12 @@ make windows-tor
 ```
 
 The packaging script verifies a pinned SHA256 for the downloaded Tor Expert
-Bundle before copying it into the release directory. The Tor binary is bundled;
-the runtime data directory, hidden-service key, and control cookie are still
-created under the user's Bitflash data directory.
+Bundle before copying it into the release directory. When `gpg` is available it
+also verifies the matching `.asc` signature against the pinned Tor Browser
+Developers signing-key fingerprint. Release builds should use
+`TOR_VERIFY_GPG=required make windows-tor` to make that second check mandatory.
+The Tor binary is bundled; the runtime data directory, hidden-service key, and
+control cookie are still created under the user's Bitflash data directory.
 
 To point at a specific Tor executable: