The GPG key used to sign GitLab Runner packages has been rotated

This post details the rotation of the GPG key used to sign GitLab Runner packages due to a security incident where the key and other distribution tokens were not secured according to policy. While no evidence of unauthorized package modification was found, the GPG key and other tokens have been rotated out of an abundance of caution. Users who employ package signature verification are instructed to update their GPG keys. New users should download the new key. Shared runner users are unaffected.