Rudder

Currently we:

• do not use https to download apt keys
• do not document rpm key import

On APT systems, we should always use curl | gpg, becuse old gpg version do not know hkps and can only download using hkp (http).

On RPM systems we should import our key using https before creating the repo, to avoid having to check the key when running the fist update.

We shouldn't use short ids but fingerprints (or the key url in our repo directly).