Add note about expired Debian gpg signing keys to CHANGES.md

1 files changed, 6 insertions, 0 deletions

diff --git a/CHANGES.md b/CHANGES.md

index 482863c0e8..b0fbc5a452 100644
--- a/CHANGES.md
+++ b/CHANGES.md
@@ -7,6 +7,12 @@ This release removes the deprecated `GET /_synapse/admin/v1/users/<user_id>` adm
 
 This release requires Application Services to use type `m.login.application_service` when registering users via the `/_matrix/client/r0/register` endpoint to comply with the spec. Please ensure your Application Services are up to date.
 
+If you are using the `packages.matrix.org` Debian repository for Synapse packages, note that our gpg signing keys have rotated and the old pair have expired. You can pull the latest keys with:
+
+```
+sudo wget -O /usr/share/keyrings/matrix-org-archive-keyring.gpg https://packages.matrix.org/debian/matrix-org-archive-keyring.gpg
+```
+
 Bugfixes
 --------