We are also looking at creating more robust signing scheme with GnuPG, and we will add the fingerprint of our certificate in another "public" ETH transaction from our main devfee account, which will be announced in advance. This will add additional layer of security, making impossible for someone to try releasing fake versions of PhoenixMiner.
That's excellent news. I suggest you make your public signing key available on at least two or three hosting servers as well. The redundancy is a security feature. Github allows you to upload your key and associate it with your profile, you can use Keybase to host your public key, and of course you can post it here on the forum, in an appropriate thread in the reputation board.