i think they just put their pgp pubkey in an op_return. blockstream has their key hosted on their site.