On Fri, Aug 9, 2019 at 10:49 AM François Kooman <fkooman@tuxed.net> wrote:

The only thing relevant at this moment is, I think, whether or not to
include Minisign in the Fedora packaging guidelines next to PGP as an
option to verify source tarballs for use by packagers when upstream
signs their software using signify/Minisign. That's all that needs to be
discussed. As stated before, I am willing to work on this.


I would agree with that.  For that matter, the guideline is a "SHOULD", it's not a must - and it relies on the decision that upstream makes.  https://docs.fedoraproject.org/en-US/packaging-guidelines/#_source_file_verification

If upstream decides to use minisign, we should accommodate that decision.  I believe the goal of the guideline is to verify where possible - and shouldn't mean that if upstream doesn't use PGP, then forget about it.  That, IMO would defeat the intent of the guideline.   

What you should do François is simply create a DRAFT guideline using the current published as a template and then open a ticket for review with the packaging committee.