The URL http://syncthing.net/security.html now contains the relevant GPG keys for checking signatures (as well as a procedure for doing so) and instructions for sending security related bug reports (that may be sensitive).
There’s a new GPG key for signing releases, separate from my private one (so other people can do releases…).