Tarball verification update

I'd like to see several improvements to the code verification for MariaDB. Porters should always have a way to validate that the tarball they've downloaded has not been tampered with.

1. Only PGP signed MD5 hashes available for downloadable tarballs. Please update the hashes to SHA256 and provide signatures for these as well.
2. Documentation on how to verify your downloaded tarball seems to be missing
3. PGP code signing key not published on the website (yet on https://yum.mariadb.org)