Releases signed by Phil's key, not Nigel's.

State a more general policy of PGP signing, mention trust paths, cite
the main public keyserver pool, provide a link to a trustpath display
between Nigel's key and Phil's.

Provide Phil's current PGP keyid (noting will change in 2013).

Bounce via a redirector, on Phil's security site, because:
 (1) xfpt barfs on &url(..) where the URL contains an ampersand
 (2) No ampersands means less debugging across various platforms
 (3) The redirector is https: with a public cert, where www.exim.org
     does not have a cert (with that name, at this time).

All keys cited in 0xLong form (16 hex characters).

Nits:
 (1) URL is given with https:// on one line, the rest on the next
 (2) using alt text does not give the URL in the .txt format, despite
     the docs, because we build .txt from w3m -dump, so the HTML form is
     used.
 (3) Ideally, we'll get around to having https://www.exim.org/ exist and
     be usable for this redirect.

Side-effects:
 (1) My name is in The Spec for the first time. :)