doc: additional note in README(.md) informing users that they may nee…

[haqer1]

…d to import a key used to sign a release & check whether it is a sub-key of a primary key listed in README(.md) (which itself isn't listed in it)...

Additional README.md update

Fixes: #32559

Checklist

• documentation is changed or added
• commit message follows commit guidelines

Note

This is part 2 to simplify closure of part 1 in PR #32591 (this PR is mutually exclusive with PR #32655)

[haqer1]

Currently, a user would be quite likely inclined to import just a single key seen as used to sign a release.

If it's a sub-key, he/she would need to spend a bit of time to deal with it.[1][2]
I believe, such misuse of time needs to be minimized with 1 or 2 thought-out sentences (which people more familiar with the nuances than a stranger are in a better position to provide to reduce the time spent on this aspect).

P.S.
[1] E.g.,
looking the key up over https leads to a security warning:

[2] Googling can lead to another issue or two, with question(s) why this key isn't listed in the README, like:
#23992 (comment)
[3] I'm a minimalist in such situations, & would be inclined to import a single key rather than 10 (which also involves less network traffic & waiting), so i'd prefer landing of this PR to landing of #32655.

[MylesBorins]

I don't think this changed text maintains the original intention of the copy. I prefer where #32655 is going and think this PR can likely be closed

[jasnell]

Doesn't look like this is going to move forward.